Open_Ultra_SAST/benchmarks/pairs/vfc/curl-cve-2022-32208/fixed.c

/* Provenance: curl/curl read_data (fixed).
 * repo: curl/curl
 * commit: 6ecdf5136b52af747e7bda08db9a748256b1cd09
 * parent: 2b67a0a1129b20a56ed04859fec8999f5c0c4280
 * commit_url: https://github.com/curl/curl/commit/6ecdf5136b52af747e7bda08db9a748256b1cd09
 * cve: CVE-2022-32208
 * license: curl
 * function: read_data
 * relpath: lib/krb5.c
 * provenance: human
 * mechanism: other
 */

static CURLcode read_data(struct connectdata *conn,
                          curl_socket_t fd,
                          struct krb5buffer *buf)
{
  int len;
  CURLcode result;
  int nread;

  result = socket_read(fd, &len, sizeof(len));
  if(result)
    return result;

  if(len) {
    /* only realloc if there was a length */
    len = ntohl(len);
    if(len > CURL_MAX_INPUT_LENGTH)
      len = 0;
    else
      buf->data = Curl_saferealloc(buf->data, len);
  }
  if(!len || !buf->data)
    return CURLE_OUT_OF_MEMORY;

  result = socket_read(fd, buf->data, len);
  if(result)
    return result;
  nread = conn->mech->decode(conn->app_data, buf->data, len,
                             conn->data_prot, conn);
  if(nread < 0)
    return CURLE_RECV_ERROR;
  buf->size = (size_t)nread;
  buf->index = 0;
  return CURLE_OK;
}