diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index 88500e9e50..845bc9a4d8 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -2,6 +2,7 @@ #include "zeek/file_analysis/File.h" +#include #include #include "zeek/Event.h" @@ -431,6 +432,15 @@ void File::DeliverStream(const u_char* data, uint64_t len) void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset) { + if ( std::numeric_limits::max() - offset < len ) + { + reporter->Weird(this, "file_offset_overflow", + zeek::util::fmt("offset=%" PRIx64 " len=%" PRIx64, offset, len), + GetSource().c_str()); + + len = std::numeric_limits::max() - offset; + } + // Potentially handle reassembly and deliver to the stream analyzers. if ( file_reassembler ) {