From b3a695e9f38a42f1ef0cade0d5e1fe60cf68864e Mon Sep 17 00:00:00 2001

From: akallabeth <akallabeth@posteo.net>

Date: Thu, 13 Oct 2022 08:36:26 +0200

Subject: [PATCH] Ensure urb_create_iocompletion uses size_t for calculation

(cherry picked from commit de7e0f062ee53d00b4a966a43855a716e3478150)

---

 channels/urbdrc/client/data_transfer.c | 8 +++++++-

 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c

index 80e84af48..8642c8506 100644

--- a/channels/urbdrc/client/data_transfer.c

+++ b/channels/urbdrc/client/data_transfer.c

@@ -97,7 +97,13 @@ static wStream* urb_create_iocompletion(UINT32 InterfaceField, UINT32 MessageId,

                                         UINT32 OutputBufferSize)

 {

 	const UINT32 InterfaceId = (STREAM_ID_PROXY << 30) | (InterfaceField & 0x3FFFFFFF);

-	wStream* out = Stream_New(NULL, OutputBufferSize + 28);

+

+#if UINT32_MAX >= SIZE_MAX

+	if (OutputBufferSize > UINT32_MAX - 28ull)

+		return NULL;

+#endif

+

+	wStream* out = Stream_New(NULL, OutputBufferSize + 28ull);

 	if (!out)

 		return NULL;

-- 

2.37.1