diff options
| author | phk <phk@FreeBSD.org> | 1997-03-18 07:54:24 +0000 |
|---|---|---|
| committer | phk <phk@FreeBSD.org> | 1997-03-18 07:54:24 +0000 |
| commit | 2efc53e73756a04f02f069ad810e2e8f66fd7aee (patch) | |
| tree | a68e0229045d0ebf5beba47239261415bdaa4aaf /lib/libc/stdlib/malloc.c | |
| parent | 3a234a3e95bb2745fab8c3c6cf5beb0b694101c8 (diff) | |
| download | FreeBSD-src-2efc53e73756a04f02f069ad810e2e8f66fd7aee.zip FreeBSD-src-2efc53e73756a04f02f069ad810e2e8f66fd7aee.tar.gz | |
Check for overflow in size argument.
Tested by: Joel Maslak <j@pobox.com>
Closes: PR kern/2964
Diffstat (limited to 'lib/libc/stdlib/malloc.c')
| -rw-r--r-- | lib/libc/stdlib/malloc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c index 6462ad1..f1eaffe 100644 --- a/lib/libc/stdlib/malloc.c +++ b/lib/libc/stdlib/malloc.c @@ -6,7 +6,7 @@ * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp * ---------------------------------------------------------------------------- * - * $Id$ + * $Id: malloc.c,v 1.21 1997/02/22 15:03:12 peter Exp $ * */ @@ -731,7 +731,9 @@ imalloc(size_t size) if (suicide) abort(); - if (size <= malloc_maxsize) + if ((size + malloc_pagesize) < size) /* Check for overflow */ + result = 0; + else if (size <= malloc_maxsize) result = malloc_bytes(size); else result = malloc_pages(size); |
