Permalink
Browse files

Avoid overflowing allocation size in calloc()

  • Loading branch information...
1 parent 9333e50 commit 2965eca30c408c13473c4146a9d47d547d288db1 @xiw xiw committed Apr 14, 2012
Showing with 6 additions and 2 deletions.
  1. +6 −2 nedmalloc.c
View
@@ -2018,8 +2018,12 @@ NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedpmalloc(nedpool *p, size_t size)
}
NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedpcalloc(nedpool *p, size_t no, size_t size) THROWSPEC
{
- unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, no*size);
- return nedpmalloc2(p, size*no, 0, M2_ZERO_MEMORY|flags);
+ size_t bytes=no*size;
+ /* Avoid multiplication overflow. */
+ if(size && no!=bytes/size)
+ return 0;
+ unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, bytes);
+ return nedpmalloc2(p, bytes, 0, M2_ZERO_MEMORY|flags);
}
NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedprealloc(nedpool *p, void *mem, size_t size) THROWSPEC
{

0 comments on commit 2965eca

Please sign in to comment.