diff options
| author | Don Anderson <dda@ddanderson.com> | 2016-02-02 14:46:01 -0500 |
|---|---|---|
| committer | Don Anderson <dda@ddanderson.com> | 2016-02-02 14:46:01 -0500 |
| commit | a8ea2664db11e181e391f1642d31e368ee4de279 (patch) | |
| tree | 370838e1b0af3c298c20192462b3870c0f220802 | |
| parent | 3544728eb8be319cf93931251195ca77dd18c4ad (diff) | |
| download | mongo-a8ea2664db11e181e391f1642d31e368ee4de279.tar.gz | |
WT-2375 Added a buffer overflow check during unpack for reliable termination.
| -rw-r--r-- | src/include/packing.i | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/include/packing.i b/src/include/packing.i index 784a55ef2ae..374dbd2fba3 100644 --- a/src/include/packing.i +++ b/src/include/packing.i @@ -677,6 +677,8 @@ __wt_struct_unpackv(WT_SESSION_IMPL *session, if (fmt[0] != '\0' && fmt[1] == '\0') { pv.type = fmt[0]; + if (p >= end) + return (ENOMEM); if ((ret = __unpack_read(session, &pv, &p, size)) == 0) WT_UNPACK_PUT(session, pv, ap); return (0); @@ -684,6 +686,8 @@ __wt_struct_unpackv(WT_SESSION_IMPL *session, WT_RET(__pack_init(session, &pack, fmt)); while ((ret = __pack_next(&pack, &pv)) == 0) { + if (p >= end) + return (ENOMEM); WT_RET(__unpack_read(session, &pv, &p, (size_t)(end - p))); WT_UNPACK_PUT(session, pv, ap); } |