bound len

2012-11-27 22:01:37 -08:00
parent 039b1941ea
commit f97f15a86c
1 changed files with 2 additions and 0 deletions
--- a/appl/test/nt_gss_common.c
+++ b/appl/test/nt_gss_common.c
@@ -86,6 +86,8 @@ nt_read_token (int sock, gss_buffer_t buf)
 	| (net_len[2] << 16)
 	| (net_len[3] << 24);

+    if (len > INT_MAX/16)
+	errx(1, "len too large");
    buf->length = len;
    buf->value  = malloc(len);
    if (read (sock, buf->value, len) != len)