maptree.c: fix Untrusted loop bound (CID 1174469)

MapServer · May 23, 2021 · aeae5da · aeae5da
1 parent b4f5819
commit aeae5da
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/maptree.c b/maptree.c
@@ -520,6 +520,8 @@ static void searchDiskTreeNode(SHPTreeHandle disktree, rectObj aoi, ms_bitarray
   if( fread( &numsubnodes, 4, 1, disktree->fp ) != 1 )
     goto error;
   if ( disktree->needswap ) SwapWord ( 4, &numsubnodes );
+  if( numsubnodes < 0 || numsubnodes > INT_MAX / 4 )
+    goto error;
 
   for(i=0; i<numsubnodes; i++)
     searchDiskTreeNode(disktree, aoi, status);