Merge pull request #3353 from guidovranken/v2_decoder-overflow-rce-fix

V2 decoder overflow RCE fix

RELICENSE/guidovranken.md

+# Permission to Relicense under MPLv2 or any other OSI approved license chosen by the current ZeroMQ BDFL
+
+This is a statement by Guido Vranken that grants permission to
+relicense its copyrights in the libzmq C++ library (ZeroMQ) under the
+Mozilla Public License v2 (MPLv2) or any other Open Source Initiative
+approved license chosen by the current ZeroMQ BDFL (Benevolent
+Dictator for Life).
+
+A portion of the commits made by the Github handle "guidovranken", with
+commit author "Guido Vranken <guidovranken@gmail.com>", are
+copyright of Guido Vranken.  This document hereby grants the libzmq
+project team to relicense libzmq, including all past, present and
+future contributions of the author listed above.
+
+Guido Vranken
+2019/01/08
+

src/v2_decoder.cpp

@@ -115,8 +115,8 @@ int zmq::v2_decoder_t::size_ready (uint64_t msg_size_,
 
     shared_message_memory_allocator &allocator = get_allocator ();
     if (unlikely (!_zero_copy
-                  || ((unsigned char *) read_pos_ + msg_size_
-                      > (allocator.data () + allocator.size ())))) {
+                  || msg_size_ >
+                  (size_t)(allocator.data () + allocator.size () - read_pos_))) {
         // a new message has started, but the size would exceed the pre-allocated arena
         // this happens every time when a message does not fit completely into the buffer
         rc = _in_progress.init_size (static_cast<size_t> (msg_size_));