diff options
| author | Ondřej Bílka <neleai@seznam.cz> | 2015-07-11 17:44:10 +0200 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2016-01-29 18:38:16 +0100 |
| commit | b5cba5cff937e5336ff23380785da80cab09146c (patch) | |
| tree | e5f52058945bd1d76aa3ebdd37ed0a6e744455f5 | |
| parent | fd6e33ebd157966fed025a8cf68f2f0835dcbf02 (diff) | |
| download | glibc-b5cba5cff937e5336ff23380785da80cab09146c.tar.gz glibc-b5cba5cff937e5336ff23380785da80cab09146c.tar.xz glibc-b5cba5cff937e5336ff23380785da80cab09146c.zip | |
Handle overflow in __hcreate_r
Hi, As in bugzilla entry there is overflow in hsearch when looking for prime number as SIZE_MAX - 1 is divisible by 5. We fix that by rejecting large inputs before looking for prime. * misc/hsearch_r.c (__hcreate_r): Handle overflow. (cherry picked from commit 2f5c1750558fe64bac361f52d6827ab1bcfe52bc)
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | misc/hsearch_r.c | 9 |
2 files changed, 13 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog index 871c722510..1ea2c735b7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2015-08-25 Ondřej Bílka <neleai@seznam.cz> + + [BZ #18240] + * misc/hsearch_r.c (__hcreate_r): Handle overflow. + 2015-09-26 Paul Pluzhnikov <ppluzhnikov@google.com> [BZ #18985] diff --git a/misc/hsearch_r.c b/misc/hsearch_r.c index 81c27d800c..4414a25cba 100644 --- a/misc/hsearch_r.c +++ b/misc/hsearch_r.c @@ -19,7 +19,7 @@ #include <errno.h> #include <malloc.h> #include <string.h> - +#include <stdint.h> #include <search.h> /* [Aho,Sethi,Ullman] Compilers: Principles, Techniques and Tools, 1986 @@ -73,6 +73,13 @@ hcreate_r (nel, htab) return 0; } + if (nel >= SIZE_MAX / sizeof (_ENTRY)) + { + __set_errno (ENOMEM); + return 0; + } + + /* There is still another table active. Return with error. */ if (htab->table != NULL) return 0; |