length value limit
git-svn-id: https://asn1c.svn.sourceforge.net/svnroot/asn1c/trunk@445 59561ff5-6e30-0410-9f3c-9617f08c8826
diff --git a/skeletons/ber_tlv_length.c b/skeletons/ber_tlv_length.c
index bde022a..a0ec1e5 100644
--- a/skeletons/ber_tlv_length.c
+++ b/skeletons/ber_tlv_length.c
@@ -51,6 +51,19 @@
}
if(oct == 0) {
+
+ /*
+ * Here length may be very close or equal to 2G.
+ * However, the arithmetics used in other decoders
+ * often add some (small) quantities to the length,
+ * to check the resulting value against some limits.
+ * This may result in integer wrap-around.
+ */
+ if((len + 1024) < 0) {
+ /* Too large length value */
+ return -1;
+ }
+
*len_r = len;
return skipped;
}