Validate line_len argument to buf_append_base64() too

Based on a patch by Tom Carroll <incentivedesign@gmail.com>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/textbuf.c b/textbuf.c
index 62f279d2277022501a7166ebeacc7ad2bca79357..dc9a32e51d0f508780fca1aa5958fcc8eda36fb4 100644 (file)
--- a/textbuf.c
+++ b/textbuf.c
@@ -418,7 +418,7 @@ void buf_append_base64(struct oc_text_buf *buf, const void *bytes, int len,
        if (!buf || buf->error)
                return;
 
-       if (len < 0) {
+       if (len < 0 || line_len < 0 || (line_len % 3)) {
                buf->error = -EINVAL;
                return;
        }