ei: integer overflow in string/atom encoding

ei_encode_atom() and ei_encode_string() use strlen() to get the length
of the buffer. As strlen() returns an unsigned long long and both ei
functions take a signed integer, the length fields may overflow.

Check the results of strlen can be held in a signed integer.

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/erl_interface/src/encode/encode_string.c b/lib/erl_interface/src/encode/encode_string.c
index 1d342cb605..593bbf2b6d 100644
--- a/lib/erl_interface/src/encode/encode_string.c
+++ b/lib/erl_interface/src/encode/encode_string.c
@@ -17,6 +17,7 @@
  * %CopyrightEnd%
  */
 #include <string.h>
+#include <limits.h>
 #include "eidef.h"
 #include "eiext.h"
 #include "putget.h"
@@ -24,7 +25,10 @@
 
 int ei_encode_string(char *buf, int *index, const char *p)
 {
-    return ei_encode_string_len(buf, index, p, strlen(p));
+    size_t len = strlen(p);
+
+    if (len >= INT_MAX) return -1;
+    return ei_encode_string_len(buf, index, p, len);
 }
 
 int ei_encode_string_len(char *buf, int *index, const char *p, int len)