Re: [PATCH 2/3] connection: Prevent integer overflow in DIV_ROUNDUP.

2018-08-17 Thread Derek Foreman
On 2018-08-17 05:39 AM, Pekka Paalanen wrote: > On Tue, 14 Aug 2018 13:07:52 +0200 > Michal Srb wrote: > >> The DIV_ROUNDUP macro would overflow when trying to round values higher >> than MAX_UINT32 - (a - 1). The result is 0 after the division. This is >> potential security issue when demarshall

Re: [PATCH 2/3] connection: Prevent integer overflow in DIV_ROUNDUP.

2018-08-17 Thread Pekka Paalanen
On Tue, 14 Aug 2018 13:07:52 +0200 Michal Srb wrote: > The DIV_ROUNDUP macro would overflow when trying to round values higher > than MAX_UINT32 - (a - 1). The result is 0 after the division. This is > potential security issue when demarshalling an array because the length > check is performed wi

[PATCH 2/3] connection: Prevent integer overflow in DIV_ROUNDUP.

2018-08-14 Thread Michal Srb
The DIV_ROUNDUP macro would overflow when trying to round values higher than MAX_UINT32 - (a - 1). The result is 0 after the division. This is potential security issue when demarshalling an array because the length check is performed with the overflowed value, but then the original huge value is st