Use inline functions to convert buffer data to scalars.

* common/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

Commit 91b826a38880fd8a989318585eb502582636ddd8 was not enough to
avoid all sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that once and for
all almost all uses of "<< 24" and "<< 8" are changed by this patch to
use an inline function from host2net.h.

Signed-off-by: Werner Koch <wk@gnupg.org>

1 files changed, 3 insertions, 4 deletions

diff --git a/g13/mount.c b/g13/mount.c
index a9203d11f..8d1c0150f 100644
--- a/g13/mount.c
+++ b/g13/mount.c
@@ -37,6 +37,7 @@
 #include "call-gpg.h"
 #include "mountinfo.h"
 #include "runner.h"
+#include "host2net.h"
 
 
 /* Parse the header prefix and return the length of the entire header.  */
@@ -50,8 +51,7 @@ parse_header (const char *filename,
   if (packetlen != 32)
     return gpg_error (GPG_ERR_BUG);
 
-  len = ((packet[2] << 24) | (packet[3] << 16)
-         | (packet[4] << 8) | packet[5]);
+  len = buf32_to_uint (packet+2);
   if (packet[0] != (0xc0|61) || len < 26
       || memcmp (packet+6, "GnuPG/G13", 10))
     {
@@ -76,8 +76,7 @@ parse_header (const char *filename,
       return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
     }
 
-  len = ((packet[20] << 24) | (packet[21] << 16)
-         | (packet[22] << 8) | packet[23]);
+  len = buf32_to_uint (packet+20);
 
   /* Do a basic sanity check on the length.  */
   if (len < 32 || len > 1024*1024)