donau

commit d3974836d98150fceebb058124276b5f8d42ab06
parent d3df720e43fd1cc1332ee6e83eb9041d04659819
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Sun, 19 Jul 2026 23:46:59 +0200

add more bounds checks

Diffstat:
M
src/pq/pq_query_helper.c
 | 
6
++++++

1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/pq/pq_query_helper.c b/src/pq/pq_query_helper.c
@@ -675,6 +675,7 @@ extract_array_generic (
 
   data = PQgetvalue (result, row, col_num);
   FAIL_IF (NULL == data);
+  const char *const data_end = data + (size_t) data_sz;
 
   {
     struct GNUNET_PQ_ArrayHeader_P *h =
@@ -718,12 +719,17 @@ extract_array_generic (
       uint32_t val;
       size_t sz;
 
+      /* Bounds-check every read against the end of the Postgres value;
+         'sz' and the number of iterations are taken from the (potentially
+         corrupt) blob and must never let us read past 'data_end'. */
+      FAIL_IF (sizeof(val) > (size_t) (data_end - in));
       GNUNET_memcpy (&val,
                      in,
                      sizeof(val));
       sz = ntohl (val);
       FAIL_IF (sizeof(be) > sz);
       in += sizeof(val);
+      FAIL_IF (sz > (size_t) (data_end - in));
       GNUNET_memcpy (&be,
                      in,
                      sizeof(be));