Don't use ntohl().

Add min/max bufsize check

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index c72198b40737bee2d6256a4b29798a1546a04f78..ff6a761f47ae0ecebc812a67021ec6d0b3dc9955 100644 (file)
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -124,15 +124,16 @@ sb_sasl_remove( Sockbuf_IO_Desc *sbiod )
 }
 
 static ber_len_t
-sb_sasl_pkt_length( const char *buf, int debuglevel )
+sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
 {
        ber_len_t               size;
-       long                    tmp;
 
        assert( buf != NULL );
 
-       tmp = *((long *)buf);
-       size = ntohl( tmp );
+       size = buf[0] << 24
+               | buf[1] << 16
+               | buf[2] << 8
+               | buf[3];
    
        /* we really should check against actual buffer size set
         * in the secopts.
@@ -767,7 +768,10 @@ int ldap_pvt_sasl_secprops(
                                return LDAP_NOT_SUPPORTED;
                        }
 
-                       if( maxbufsize > SASL_MAX_BUFF_SIZE ) {
+                       if( maxbufsize && (( maxbufsize < SASL_MIN_BUFF_SIZE ) {
+                               || (maxbufsize > SASL_MAX_BUFF_SIZE ))
+                       {
+                               /* bad maxbufsize */
                                return LDAP_PARAM_ERROR;
                        }