Re: connection: Detect overflows in length field.

On Thu, Aug 2, 2018 at 8:37 PM Michal Srb wrote: > > The length field can be any uint32 value. Two kinds of overflows may > happen on 32 bit systems: > > 1) If the value is in range [UINT32_MAX-3, UINT32_MAX], the DIV_ROUNDUP > will turn it into 0. Then `next` equals `p` and so the big `length` is

[PATCH] connection: Detect overflows in length field.

The length field can be any uint32 value. Two kinds of overflows may happen on 32 bit systems: 1) If the value is in range [UINT32_MAX-3, UINT32_MAX], the DIV_ROUNDUP will turn it into 0. Then `next` equals `p` and so the big `length` is not detected. But the wl_array will contain the original big