mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
927f901969
The party info contained in the response might be of an arbitrary size. Check for an overflow before allocating the party info buffer for the combined request and response party info data. With a very large response party info size, the combined size might overflow (i.e. wrap around), causing a too small buffer being allocated and the following memcpy's would cause an out of bounds write. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>