common, trust: Avoid integer overflow

This fixes issues pointed in:
https://bugzilla.redhat.com/show_bug.cgi?id=985445
except for p11-kit/conf.c:read_config_file(), which was rewritten using
mmap() and thus length calculation is no longer needed.

1 files changed, 6 insertions, 2 deletions

diff --git a/common/compat.c b/common/compat.c
index de5b99b..02e6408 100644
--- a/common/compat.c
+++ b/common/compat.c
@@ -41,6 +41,7 @@
 #define _XOPEN_SOURCE 700
 
 #include "compat.h"
+#include "debug.h"
 
 #include <assert.h>
 #include <dirent.h>
@@ -503,8 +504,11 @@ strconcat (const char *first,
 
 	va_start (va, first);
 
-	for (arg = first; arg; arg = va_arg (va, const char*))
-	       length += strlen (arg);
+	for (arg = first; arg; arg = va_arg (va, const char*)) {
+		size_t old_length = length;
+		length += strlen (arg);
+		return_val_if_fail (length >= old_length, NULL);
+	}
 
 	va_end (va);