Date: Sun, 13 Aug 2006 21:54:47 +0000 (UTC) From: Colin Percival <cperciva@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/lib/libc/stdlib malloc.c Message-ID: <200608132154.k7DLsl2d080953@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
cperciva 2006-08-13 21:54:47 UTC
FreeBSD src repository
Modified files:
lib/libc/stdlib malloc.c
Log:
Correctly handle the case in calloc(num, size) where
(size_t)(num * size) == 0
but both num and size are nonzero.
Reported by: Ilja van Sprundel
Approved by: jasone
Security: Integer overflow; calloc was allocating 1 byte in
response to a request for a multiple of 2^32 (or 2^64)
bytes instead of returning NULL.
Revision Changes Path
1.134 +1 -1 src/lib/libc/stdlib/malloc.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200608132154.k7DLsl2d080953>