commit 7483ab7036549a14919f0df2420ee2ef1acdb728
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 01 01:03:45 2021 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 01 01:03:45 2021 +0000
tree b9b027af6f181031574ee05829b5fba078b01f2b
parent 458b40b7304df6df38006e67586ad01d7ed15b36
parent 4907264bdcc3da0477bb5648e55c07705e2793ba

Snap for 7510676 from 4907264bdcc3da0477bb5648e55c07705e2793ba to sc-d1-release

Change-Id: Icda2f661eb62dab9018ffbe581a803c2b8a8bc15

src/cppbor_parse.cpp

diff --git a/src/cppbor_parse.cpp b/src/cppbor_parse.cpp
index f5e8fcf..964a72d 100644
--- a/src/cppbor_parse.cpp
+++ b/src/cppbor_parse.cpp
@@ -96,7 +96,8 @@
                                                       const uint8_t* valueBegin, const uint8_t* end,
                                                       const std::string& errLabel,
                                                       ParseClient* parseClient) {
-    if (end - valueBegin < static_cast<ssize_t>(length)) {
+    ssize_t signed_length = static_cast<ssize_t>(length);
+    if (end - valueBegin < signed_length || signed_length < 0) {
         parseClient->error(hdrBegin, insufficientLengthString(length, end - valueBegin, errLabel));
         return {hdrBegin, nullptr /* end parsing */};
     }