commit da91e20fe73e618932eba76ae415a8dbd9b7e894
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 01 01:05:21 2021 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 01 01:05:21 2021 +0000
tree b9b027af6f181031574ee05829b5fba078b01f2b
parent fce4c88818d570a8b945bf251299d5f4c7b1fbce
parent 7301ee25d29c723b341e05da57522d6727c81154

Snap for 7509579 from 7301ee25d29c723b341e05da57522d6727c81154 to sc-v2-release

Change-Id: Ic49c7e1c896dcee9488b52e66f132811edb597dc

src/cppbor_parse.cpp

diff --git a/src/cppbor_parse.cpp b/src/cppbor_parse.cpp
index f5e8fcf..964a72d 100644
--- a/src/cppbor_parse.cpp
+++ b/src/cppbor_parse.cpp
@@ -96,7 +96,8 @@
                                                       const uint8_t* valueBegin, const uint8_t* end,
                                                       const std::string& errLabel,
                                                       ParseClient* parseClient) {
-    if (end - valueBegin < static_cast<ssize_t>(length)) {
+    ssize_t signed_length = static_cast<ssize_t>(length);
+    if (end - valueBegin < signed_length || signed_length < 0) {
         parseClient->error(hdrBegin, insufficientLengthString(length, end - valueBegin, errLabel));
         return {hdrBegin, nullptr /* end parsing */};
     }