Skip to content

Commit 429ea28

Browse files
committed
A try to get rid of spam reports about "vulnerabilities" that are not real.
No need to check integer overflow since that is 2*16*count = 2^32-1 ; => count = 128 M entries, That would be 2Gb, which is over MAX_MEMORY_FOR_ALLOC, even for large file size. I added this check to silence the continuous spam reports of people using AI to catch what they think are "vulnerabilities".
1 parent 3fd1a71 commit 429ea28

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

src/cmsnamed.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,11 @@ cmsBool GrowMLUpool(cmsMLU* mlu)
8787
return TRUE;
8888
}
8989

90-
9190
// Grows a entry table for a MLU. Each time this function is called, table size is multiplied times two.
91+
// No need to check integer overflow since that is 2*16*count = 2^32-1 ; => count = 128 M entries,
92+
// That would be 2Gb, which is over MAX_MEMORY_FOR_ALLOC, even for large file size.
93+
// I added this check to silence the continuous spam reports of people using AI to catch what
94+
// they think are "vulnerabilities".
9295
static
9396
cmsBool GrowMLUtable(cmsMLU* mlu)
9497
{
@@ -100,8 +103,12 @@ cmsBool GrowMLUtable(cmsMLU* mlu)
100103

101104
AllocatedEntries = mlu ->AllocatedEntries * 2;
102105

103-
// Check for overflow
104-
if (AllocatedEntries / 2 != mlu ->AllocatedEntries) return FALSE;
106+
// Check for overflow in count doubling: if wrapped, result < original
107+
if (AllocatedEntries < mlu->AllocatedEntries) return FALSE;
108+
109+
// Check for overflow in byte-size multiplication:
110+
// dividing back by sizeof must recover the original count
111+
if ((AllocatedEntries * sizeof(_cmsMLUentry)) / sizeof(_cmsMLUentry) != AllocatedEntries) return FALSE;
105112

106113
// Reallocate the memory
107114
NewPtr = (_cmsMLUentry*)_cmsRealloc(mlu ->ContextID, mlu ->Entries, AllocatedEntries*sizeof(_cmsMLUentry));

0 commit comments

Comments
 (0)