From d69d3c4aad5fb14160ec40fc01980bd1be5986a1 Mon Sep 17 00:00:00 2001 From: Steven Fackler Date: Mon, 1 Jun 2015 20:54:34 -0700 Subject: [PATCH] Fix overflow check --- src/message.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/message.rs b/src/message.rs index 68aca5de..aa47f621 100644 --- a/src/message.rs +++ b/src/message.rs @@ -246,7 +246,10 @@ impl WriteMessage for W { } // add size of length value - try!(self.write_u32::(try!(u32::from_usize(buf.len() + mem::size_of::())))); + if buf.len() > u32::max_value() as usize - mem::size_of::() { + return Err(io::Error::new(io::ErrorKind::InvalidInput, "value too large to transmit")); + } + try!(self.write_u32::((buf.len() + mem::size_of::()) as u32)); try!(self.write_all(&*buf)); Ok(())