session: Handle overflows

Signed-off-by: Ian Moffett <ian@osmora.org>

1 files changed, 4 insertions, 1 deletions

diff --git a/lib/libostp/session.c b/lib/libostp/session.c
index 35d7a8d..26b72bb 100644
--- a/lib/libostp/session.c
+++ b/lib/libostp/session.c
@@ -123,10 +123,13 @@ send_auth(int sockfd, const unsigned char *session_key, struct ostp_session *s)
     }
 
     /* Did it fail? */
-    if (auth.code != AUTH_SUCCESS) {
+    if (auth.code != AUTH_SUCCESS && auth.code < NELEM(auth_codestr)) {
         LOG("Failed to authenticate, server says: %s\n",
             auth_codestr[auth.code]);
         return -1;
+    } else if (auth.code >= NELEM(auth_codestr)) {
+        LOG("Failed to authenticate, invalid code %d\n", auth.code);
+        return -1;
     }
 
     memcpy(s->username, auth.username, sizeof(auth.username));