From 5ae11e2a3738a910d8e695b985892df745a6df34 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Sat, 25 Jul 2026 17:46:28 +0300 Subject: [PATCH] Harden stream bounds checks against pointer-arithmetic overflow --- common/parse.h | 4 ++-- common/trans.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/common/parse.h b/common/parse.h index dccdb441..3f9950ce 100644 --- a/common/parse.h +++ b/common/parse.h @@ -186,7 +186,7 @@ unsigned int in_utf16_le_terminated_as_utf8_length(struct stream *s); /******************************************************************************/ -#define s_check_rem(s, n) ((s)->p + (n) <= (s)->end) +#define s_check_rem(s, n) ((n) >= 0 && (n) <= (s)->end - (s)->p) /******************************************************************************/ /** @@ -202,7 +202,7 @@ in_utf16_le_terminated_as_utf8_length(struct stream *s); && 0 ) /******************************************************************************/ -#define s_check_rem_out(s, n) ((s)->p + (n) <= (s)->data + (s)->size) +#define s_check_rem_out(s, n) ((n) >= 0 && (n) <= (s)->size - ((s)->p - (s)->data)) /******************************************************************************/ /** diff --git a/common/trans.c b/common/trans.c index 98422406..be9a7ae3 100644 --- a/common/trans.c +++ b/common/trans.c @@ -471,8 +471,8 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size) int rcvd; if (self->status != TRANS_STATUS_UP || - size < 0 || - in_s->end + size > in_s->data + in_s->size) + size < 0 || + size > in_s->size - (in_s->end - in_s->data)) { return 1; }