*retstr = dupstr("Received broken key list from agent");
return PAGEANT_ACTION_FAILURE;
}
- n = toint(4 + GET_32BIT(p));
- if (n < 0 || keylistlen < n) {
+ n = GET_32BIT(p);
+ p += 4;
+ keylistlen -= 4;
+
+ if (n < 0 || n > keylistlen) {
*retstr = dupstr("Received broken key list from agent");
return PAGEANT_ACTION_FAILURE;
}
*retstr = dupstr("Received broken key list from agent");
return PAGEANT_ACTION_FAILURE;
}
- n = toint(4 + GET_32BIT(p));
- if (n < 0 || keylistlen < n) {
+ n = GET_32BIT(p);
+ p += 4;
+ keylistlen -= 4;
+
+ if (n < 0 || n > keylistlen) {
*retstr = dupstr("Received broken key list from agent");
return PAGEANT_ACTION_FAILURE;
}