From 51464af713d71802e3c6d5ac15f1a95132a354fe Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Mon, 20 Feb 2017 11:13:08 +0100
Subject: [PATCH] cdk_pkt_read: enforce packet limits

That ensures that there are no overflows in the subsequent
calculations.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
---
 lib/opencdk/read-packet.c |  9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/opencdk/read-packet.c b/lib/opencdk/read-packet.c
index 8055a63..ead6480 100644
--- a/lib/opencdk/read-packet.c
+++ b/lib/opencdk/read-packet.c
@@ -888,7 +888,7 @@ static void skip_packet(cdk_stream_t inp, size_t pktlen)
 	assert(pktlen == 0);
 }
 
-
+#define MAX_PACKET_LEN (1<<24)
 /**
  * cdk_pkt_read:
  * @inp: the input stream
@@ -940,6 +940,13 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 	else
 		read_old_length(inp, ctb, &pktlen, &pktsize);
 
+	/* enforce limits to ensure that the following calculations
+	 * do not overflow */
+	if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
+		_cdk_log_info("cdk_pkt_read: too long packet\n");
+		return gnutls_assert_val(CDK_Inv_Packet);
+	}
+
 	pkt->pkttype = pkttype;
 	pkt->pktlen = pktlen;
 	pkt->pktsize = pktsize + pktlen;
@@ -964,6 +971,7 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 		break;
 
 	case CDK_PKT_USER_ID:
+
 		pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id
 					      + pkt->pktlen + 1);
 		if (!pkt->pkt.user_id)