Date: Tue, 9 Mar 2010 21:06:17 +0000 (UTC) From: "Andrey A. Chernov" <ache@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r204928 - head/usr.bin/comm Message-ID: <201003092106.o29L6HJv030014@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ache Date: Tue Mar 9 21:06:17 2010 New Revision: 204928 URL: http://svn.freebsd.org/changeset/base/204928 Log: Add SIZE_MAX overflow check Modified: head/usr.bin/comm/comm.c Modified: head/usr.bin/comm/comm.c ============================================================================== --- head/usr.bin/comm/comm.c Tue Mar 9 21:06:01 2010 (r204927) +++ head/usr.bin/comm/comm.c Tue Mar 9 21:06:17 2010 (r204928) @@ -201,6 +201,8 @@ convert(const char *str) if ((n = mbstowcs(NULL, str, 0)) == (size_t)-1) return (NULL); + if (SIZE_MAX / sizeof(*buf) < n + 1) + errx(1, "conversion buffer length overflow"); if ((buf = malloc((n + 1) * sizeof(*buf))) == NULL) err(1, "malloc"); if (mbstowcs(buf, str, n + 1) != n)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201003092106.o29L6HJv030014>