From c638caa63eda76ac72aef2869b6cece4a23467f7 Mon Sep 17 00:00:00 2001
From: Wayne Davison <wayned@samba.org>
Date: Mon, 27 Feb 2006 03:12:26 +0000
Subject: [PATCH] In read_sum_head(): if we read a negative checksum count, die
 with an error.

---
 io.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/io.c b/io.c
index 8f8c5c21..475ac40f 100644
--- a/io.c
+++ b/io.c
@@ -948,6 +948,11 @@ int read_vstring(int f, char *buf, int bufsize)
 void read_sum_head(int f, struct sum_struct *sum)
 {
 	sum->count = read_int(f);
+	if (sum->count < 0) {
+		rprintf(FERROR, "Invalid checksum count %ld [%s]\n",
+			(long)sum->count, who_am_i());
+		exit_cleanup(RERR_PROTOCOL);
+	}
 	sum->blength = read_int(f);
 	if (sum->blength < 0 || sum->blength > MAX_BLOCK_SIZE) {
 		rprintf(FERROR, "Invalid block length %ld [%s]\n",
-- 
2.34.1