gss-serv.c (d4af9e693f15f5155095f38c7650b24fe74ae351) | gss-serv.c (e146993e33182e13df79b5a957f2734f663fd836) |
---|---|
1/* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */ | 1/* $OpenBSD: gss-serv.c,v 1.23 2011/08/01 19:18:15 markus Exp $ */ |
2 3/* 4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright --- 214 unchanged lines hidden (view full) --- 224 offset = oidl+6; 225 226 if (ename->length < offset+4) 227 return GSS_S_FAILURE; 228 229 name->length = get_u32(tok+offset); 230 offset += 4; 231 | 2 3/* 4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright --- 214 unchanged lines hidden (view full) --- 224 offset = oidl+6; 225 226 if (ename->length < offset+4) 227 return GSS_S_FAILURE; 228 229 name->length = get_u32(tok+offset); 230 offset += 4; 231 |
232 if (UINT_MAX - offset < name->length) 233 return GSS_S_FAILURE; |
|
232 if (ename->length < offset+name->length) 233 return GSS_S_FAILURE; 234 235 name->value = xmalloc(name->length+1); 236 memcpy(name->value, tok+offset, name->length); 237 ((char *)name->value)[name->length] = 0; 238 239 return GSS_S_COMPLETE; --- 126 unchanged lines hidden --- | 234 if (ename->length < offset+name->length) 235 return GSS_S_FAILURE; 236 237 name->value = xmalloc(name->length+1); 238 memcpy(name->value, tok+offset, name->length); 239 ((char *)name->value)[name->length] = 0; 240 241 return GSS_S_COMPLETE; --- 126 unchanged lines hidden --- |