Skip to content

Commit 4f5a582

Browse files
TreeHunter9Artyom Ivanov
andauthored
Merge commit from fork
Co-authored-by: Artyom Ivanov <artyom.ivanov@red-soft.ru>
1 parent 30c2fd4 commit 4f5a582

1 file changed

Lines changed: 8 additions & 5 deletions

File tree

src/common/classes/ClumpletReader.cpp

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -596,6 +596,8 @@ FB_SIZE_T ClumpletReader::getClumpletSize(bool wTag, bool wLength, bool wData) c
596596
return 0;
597597
}
598598

599+
const FB_UINT64 maxTotalLength = buffer_end - clumplet;
600+
599601
FB_SIZE_T rc = wTag ? 1 : 0;
600602
FB_SIZE_T lengthSize = 0;
601603
FB_SIZE_T dataSize = 0;
@@ -672,15 +674,16 @@ FB_SIZE_T ClumpletReader::getClumpletSize(bool wTag, bool wLength, bool wData) c
672674
return rc;
673675
}
674676

675-
const FB_SIZE_T total = 1 + lengthSize + dataSize;
676-
if (clumplet + total > buffer_end)
677+
// Avoid possible overflow
678+
FB_UINT64 totalLength = 1 + lengthSize + static_cast<FB_UINT64>(dataSize);
679+
if (totalLength > maxTotalLength)
677680
{
678-
invalid_structure("buffer end before end of clumplet - clumplet too long", total);
679-
const FB_SIZE_T delta = total - (buffer_end - clumplet);
681+
invalid_structure("buffer end before end of clumplet - clumplet too long", totalLength);
682+
FB_UINT64 delta = totalLength - maxTotalLength;
680683
if (delta > dataSize)
681684
dataSize = 0;
682685
else
683-
dataSize -= delta;
686+
dataSize -= static_cast<FB_SIZE_T>(delta);
684687
}
685688

686689
if (wLength) {

0 commit comments

Comments
 (0)