librpc: cab: Integer wrap protection for ndr_count_cfdata().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/librpc/ndr/ndr_cab.c b/librpc/ndr/ndr_cab.c
index 0d2b36b3249b86f135930ba003cd4d38e083ae5c..d5ab87fb0afde39711ee60953a2956145adabaac 100644 (file)
--- a/librpc/ndr/ndr_cab.c
+++ b/librpc/ndr/ndr_cab.c
@@ -57,6 +57,10 @@ uint32_t ndr_count_cfdata(const struct cab_file *r)
        uint32_t count = 0, i;
 
        for (i = 0; i < r->cfheader.cFolders; i++) {
+               if (count + r->cffolders[i].cCFData < count) {
+                       /* Integer wrap. */
+                       return 0;
+               }
                count += r->cffolders[i].cCFData;
        }