libpam: check for INT_MAX limit in ioloop

The size arguments to pam_modutil_read and pam_modutil_write are of
type int. If a negative value is specified, fail with -1 instead of
returning 0, indicating "just" a short read or write.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

1 files changed, 10 insertions, 0 deletions

diff --git a/libpam/pam_modutil_ioloop.c b/libpam/pam_modutil_ioloop.c
index 9b73ed75..72b58455 100644
--- a/libpam/pam_modutil_ioloop.c
+++ b/libpam/pam_modutil_ioloop.c
@@ -15,6 +15,11 @@ pam_modutil_read(int fd, char *buffer, int count)
 {
        int block, offset = 0;
 
+       if (count < 0) {
+               errno = EINVAL;
+               return -1;
+       }
+
        while (count > 0) {
                block = read(fd, &buffer[offset], count);
 
@@ -36,6 +41,11 @@ pam_modutil_write(int fd, const char *buffer, int count)
 {
        int block, offset = 0;
 
+       if (count < 0) {
+               errno = EINVAL;
+               return -1;
+       }
+
        while (count > 0) {
                block = write(fd, &buffer[offset], count);