get_map_ranges: check for overflow

The kernel accepts u32 values, so make sure that userspace
is not passing large values.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

diff --git a/libmisc/idmapping.c b/libmisc/idmapping.c
index 0dce634d0825c0081cf7ca1217f471cd5cab7a83..f105a4125997df9e48cf15f8bdf39cba37b00824 100644 (file)
--- a/libmisc/idmapping.c
+++ b/libmisc/idmapping.c
@@ -83,6 +83,16 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
                        free(mappings);
                        return NULL;
                }
+               if (mapping->upper > UINT_MAX ||
+                       mapping->lower > UINT_MAX ||
+                       mapping->count > UINT_MAX)  {
+                       free(mappings);
+                       return NULL;
+               }
+               if (mapping->lower + mapping->count < mapping->lower) {
+                       free(mapping);
+                       return NULL;
+               }
        }
        return mappings;
 }