* sunrpc/rpc/xdr.h (struct XDR.xdr_ops.x_inline): 2nd arg

	is now u_int, not int.
	(struct XDR.x_handy): Now u_int, not int.
	* sunrpc/xdr_mem.c: Include <limits.h>.
	(xdrmem_getlong, xdrmem_putlong, xdrmem_getbytes, xdrmem_putbytes,
	xdrmem_inline, xdrmem_getint32, xdrmem_putint32):
	x_handy is now unsigned, not signed.
	Do not decrement x_handy if no change is made.
	(xdrmem_setpos): Check for int overflow.
	* sunrpc/xdr_sizeof.c (x_inline): 2nd arg is now unsigned.
	(xdr_sizeof): Remove cast that is now unnecessary, now that
	x_handy is unsigned.

1 files changed, 17 insertions, 8 deletions

diff --git a/sunrpc/xdr_mem.c b/sunrpc/xdr_mem.c
index 1695feaf58..72bccc1d0d 100644
--- a/sunrpc/xdr_mem.c
+++ b/sunrpc/xdr_mem.c
@@ -39,6 +39,7 @@
  */
 
 #include <string.h>
+#include <limits.h>
 #include <rpc/rpc.h>
 
 static bool_t xdrmem_getlong (XDR *, long *);
@@ -100,8 +101,9 @@ xdrmem_destroy (XDR *xdrs)
 static bool_t
 xdrmem_getlong (XDR *xdrs, long *lp)
 {
-  if ((xdrs->x_handy -= 4) < 0)
+  if (xdrs->x_handy < 4)
     return FALSE;
+  xdrs->x_handy -= 4;
   *lp = (int32_t) ntohl ((*((int32_t *) (xdrs->x_private))));
   xdrs->x_private += 4;
   return TRUE;
@@ -115,8 +117,9 @@ xdrmem_getlong (XDR *xdrs, long *lp)
 static bool_t
 xdrmem_putlong (XDR *xdrs, const long *lp)
 {
-  if ((xdrs->x_handy -= 4) < 0)
+  if (xdrs->x_handy < 4)
     return FALSE;
+  xdrs->x_handy -= 4;
   *(int32_t *) xdrs->x_private = htonl (*lp);
   xdrs->x_private += 4;
   return TRUE;
@@ -131,8 +134,9 @@ xdrmem_putlong (XDR *xdrs, const long *lp)
 static bool_t
 xdrmem_getbytes (XDR *xdrs, caddr_t addr, u_int len)
 {
-  if ((xdrs->x_handy -= len) < 0)
+  if (xdrs->x_handy < len)
     return FALSE;
+  xdrs->x_handy -= len;
   memcpy (addr, xdrs->x_private, len);
   xdrs->x_private += len;
   return TRUE;
@@ -145,8 +149,9 @@ xdrmem_getbytes (XDR *xdrs, caddr_t addr, u_int len)
 static bool_t
 xdrmem_putbytes (XDR *xdrs, const char *addr, u_int len)
 {
-  if ((xdrs->x_handy -= len) < 0)
+  if (xdrs->x_handy < len)
     return FALSE;
+  xdrs->x_handy -= len;
   memcpy (xdrs->x_private, addr, len);
   xdrs->x_private += len;
   return TRUE;
@@ -173,7 +178,9 @@ xdrmem_setpos (xdrs, pos)
   caddr_t newaddr = xdrs->x_base + pos;
   caddr_t lastaddr = xdrs->x_private + xdrs->x_handy;
 
-  if ((long) newaddr > (long) lastaddr)
+  if ((long) newaddr > (long) lastaddr
+      || (UINT_MAX < LONG_MAX
+	  && (long) UINT_MAX < (long) lastaddr - (long) newaddr))
     return FALSE;
   xdrs->x_private = newaddr;
   xdrs->x_handy = (long) lastaddr - (long) newaddr;
@@ -188,7 +195,7 @@ xdrmem_inline (XDR *xdrs, int len)
 {
   int32_t *buf = 0;
 
-  if (xdrs->x_handy >= len)
+  if (xdrs->x_handy >= (u_int) len)
     {
       xdrs->x_handy -= len;
       buf = (int32_t *) xdrs->x_private;
@@ -205,8 +212,9 @@ xdrmem_inline (XDR *xdrs, int len)
 static bool_t
 xdrmem_getint32 (XDR *xdrs, int32_t *ip)
 {
-  if ((xdrs->x_handy -= 4) < 0)
+  if (xdrs->x_handy < 4)
     return FALSE;
+  xdrs->x_handy -= 4;
   *ip = ntohl ((*((int32_t *) (xdrs->x_private))));
   xdrs->x_private += 4;
   return TRUE;
@@ -220,8 +228,9 @@ xdrmem_getint32 (XDR *xdrs, int32_t *ip)
 static bool_t
 xdrmem_putint32 (XDR *xdrs, const int32_t *ip)
 {
-  if ((xdrs->x_handy -= 4) < 0)
+  if (xdrs->x_handy < 4)
     return FALSE;
+  xdrs->x_handy -= 4;
   *(int32_t *) xdrs->x_private = htonl (*ip);
   xdrs->x_private += 4;
   return TRUE;