Blob Blame History Raw
--- sa_common.c
+++ sa_common.c
@@ -1249,6 +1249,11 @@
 	/* Remap [unsigned] long fields */
 	d = gtypes_nr[0] - ftypes_nr[0];
 	if (d) {
+    
+    if (ftypes_nr[0] * ULL_ALIGNMENT_WIDTH < ftypes_nr[0])
+			/* Overflow */
+			return;
+
 		memmove(((char *) ps) + gtypes_nr[0] * ULL_ALIGNMENT_WIDTH,
 			((char *) ps) + ftypes_nr[0] * ULL_ALIGNMENT_WIDTH,
 			st_size - ftypes_nr[0] * ULL_ALIGNMENT_WIDTH);
@@ -1260,7 +1265,13 @@
 	/* Remap [unsigned] int fields */
 	d = gtypes_nr[1] - ftypes_nr[1];
 	if (d) {
-		memmove(((char *) ps) + gtypes_nr[0] * ULL_ALIGNMENT_WIDTH
+		
+    if (gtypes_nr[0] * ULL_ALIGNMENT_WIDTH +
+		  ftypes_nr[1] * UL_ALIGNMENT_WIDTH < ftypes_nr[1])
+        /* Overflow */
+			  return;
+
+    memmove(((char *) ps) + gtypes_nr[0] * ULL_ALIGNMENT_WIDTH
 				      + gtypes_nr[1] * UL_ALIGNMENT_WIDTH,
 			((char *) ps) + gtypes_nr[0] * ULL_ALIGNMENT_WIDTH
 				      + ftypes_nr[1] * UL_ALIGNMENT_WIDTH,
@@ -1275,6 +1286,13 @@
 	/* Remap possible fields (like strings of chars) following int fields */
 	d = gtypes_nr[2] - ftypes_nr[2];
 	if (d) {
+		
+    if (gtypes_nr[0] * ULL_ALIGNMENT_WIDTH +
+		  gtypes_nr[1] * UL_ALIGNMENT_WIDTH +
+		  ftypes_nr[2] * U_ALIGNMENT_WIDTH < ftypes_nr[2])	
+        /* Overflow */
+			  return;
+
 		memmove(((char *) ps) + gtypes_nr[0] * ULL_ALIGNMENT_WIDTH
 				      + gtypes_nr[1] * UL_ALIGNMENT_WIDTH
 				      + gtypes_nr[2] * U_ALIGNMENT_WIDTH,