V2 decoder overflow RCE fix

RELICENSE/guidovranken.md

@@ -0,0 +1,17 @@
+# Permission to Relicense under MPLv2 or any other OSI approved license chosen by the current ZeroMQ BDFL
+
+This is a statement by Guido Vranken that grants permission to
+relicense its copyrights in the libzmq C++ library (ZeroMQ) under the
+Mozilla Public License v2 (MPLv2) or any other Open Source Initiative
+approved license chosen by the current ZeroMQ BDFL (Benevolent
+Dictator for Life).
+
+A portion of the commits made by the Github handle "guidovranken", with
+commit author "Guido Vranken <guidovranken@gmail.com>", are
+copyright of Guido Vranken. This document hereby grants the libzmq
+project team to relicense libzmq, including all past, present and
+future contributions of the author listed above.
+
+Guido Vranken
+2019/01/08
+

src/v2_decoder.cpp

@@ -115,8 +115,8 @@ int zmq::v2_decoder_t::size_ready (uint64_t msg_size_,
 
  shared_message_memory_allocator &allocator = get_allocator ();
  if (unlikely (!_zero_copy
- || ((unsigned char *) read_pos_ + msg_size_
-  > (allocator.data () + allocator.size ())))) {
+ || msg_size_ >
+ (size_t)(allocator.data () + allocator.size () - read_pos_))) {
  // a new message has started, but the size would exceed the pre-allocated arena
  // this happens every time when a message does not fit completely into the buffer
  rc = _in_progress.init_size (static_cast<size_t> (msg_size_));