core: Protect against a theoretical integer overflow in parsetlv.c

* src/parsetlv.c (_gpgme_parse_tlv): Detect integer overflow.
--

Although there is no concrete case where we use for example
(to.nhdr+ti.length), it feels safer to protect against this anyway.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/parsetlv.c b/src/parsetlv.c
index 69f48eb4..e6ae44d6 100644
--- a/src/parsetlv.c
+++ b/src/parsetlv.c
@@ -98,6 +98,9 @@ _gpgme_parse_tlv (char const **buffer, size_t *size, tlvinfo_t *ti)
       ti->length = len;
     }
 
+  if (ti->length > ti->nhdr && (ti->nhdr + ti->length) < ti->length)
+    return -1;  /* Integer overflow.  */
+
   *buffer = (void*)buf;
   *size = length;
   return 0;