From fce2e16bfacfed2837851c62606a5e157b012238 Mon Sep 17 00:00:00 2001 From: Sebastien Duquette Date: Tue, 22 Oct 2019 13:48:05 -0400 Subject: [PATCH] Fix an integer overflow in ber read_enumerated `enumerated + 1` can overflow if enumerated is equal to UINT_MAX. --- ironrdp/src/ber.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ironrdp/src/ber.rs b/ironrdp/src/ber.rs index 9d758749..3926549a 100644 --- a/ironrdp/src/ber.rs +++ b/ironrdp/src/ber.rs @@ -149,7 +149,7 @@ pub fn read_enumerated(mut stream: impl io::Read, count: u8) -> io::Result { } let enumerated = stream.read_u8()?; - if enumerated + 1 > count { + if enumerated == std::u8::MAX || enumerated + 1 > count { return Err(io::Error::new( io::ErrorKind::InvalidData, "invalid enumerated value",