Bug 241022 (CVE-2007-2799)

Colin Percival discovered that the fix for CVE-2007-1536 created an integer
overflow flaw in file.  This new flaw has been assigned CVE-2007-2799.

Here is the information from Colin:

+       len = ms->o.size - ms->o.left;
+       /* * 4 is for octal representation, + 1 is for NUL */
+       psize = len * 4 + 1;
+       assert(psize > len);

On a 32-bit system, if len is 1.35GB, len * 4 + 1 = 5.4GB == 1.4GB, so
the assert will pass.  The buffer will then be overflowed (by as much
as the attacker wants, although of course he'll run into unwriteable
addresses eventually).  This looks pretty exploitable...

I think the right solution is to apply
-       assert(psize > len);
+       if (len > (SIZE_T_MAX - 1) / 4) {
+               file_oomem(ms);
+               return NULL;
+       }
and add
#include <limits.h> to the top (in place of the #include <assert.h> which
the earlier patch adds).