tree 9db1ddc212f2b617a27d041b5b5e1b44df6a952f
parent 2f49246c835feeaef2de64ed0fb4d73addd95fcd
author Petteri Aimonen <jpa@git.mail.kapsi.fi> 1592827046 +0300
committer Petteri Aimonen <jpa@git.mail.kapsi.fi> 1592827046 +0300

Fix buffer overflow when encoding bytes with size set to 65535 (#547)

On platforms where size_t equals pb_size_t, for example AVR where both
are 16-bit, or x86 and ARM when PB_FIELD_32BIT is defined, the buffer size
checks in pb_write() and pb_enc_submessage can overflow if a bytes field
has size close to maximum size value. This causes read and write out of bounds.

This issue can cause a security vulnerability if the size of a bytes field
in the structure given to pb_encode() is untrusted. Note that pb_decode()
has correct bounds checking and will reject too large values.