Handle large requests.

2 files changed, 24 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index c0c1600af9..faf2befa24 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2010-10-03  Ulrich Drepper  <drepper@gmail.com>
 
+	[BZ #12005]
+	* malloc/mcheck.c: Handle large requests.
+
 	[BZ #12077]
 	* sysdeps/x86_64/strcmp.S: Fix handling of remaining bytes in buffer
 	for strncmp and strncasecmp.
diff --git a/malloc/mcheck.c b/malloc/mcheck.c
index 524acc755c..e2eb83f41d 100644
--- a/malloc/mcheck.c
+++ b/malloc/mcheck.c
@@ -1,5 +1,6 @@
 /* Standard debugging hooks for `malloc'.
-   Copyright (C) 1990-1997,1999,2000-2002,2007 Free Software Foundation, Inc.
+   Copyright (C) 1990-1997,1999,2000-2002,2007,2010
+   Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written May 1989 by Mike Haertel.
 
@@ -25,6 +26,7 @@
 # include <stdint.h>
 # include <stdio.h>
 # include <libintl.h>
+# include <errno.h>
 #endif
 
 /* Old hook values.  */
@@ -209,6 +211,12 @@ mallochook (__malloc_size_t size, const __ptr_t caller)
   if (pedantic)
     mcheck_check_all ();
 
+  if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
+    {
+      __set_errno (ENOMEM);
+      return NULL;
+    }
+
   __malloc_hook = old_malloc_hook;
   if (old_malloc_hook != NULL)
     hdr = (struct hdr *) (*old_malloc_hook) (sizeof (struct hdr) + size + 1,
@@ -241,6 +249,12 @@ memalignhook (__malloc_size_t alignment, __malloc_size_t size,
 
   slop = (sizeof *hdr + alignment - 1) & -alignment;
 
+  if (size > ~((size_t) 0) - (slop + 1))
+    {
+      __set_errno (ENOMEM);
+      return NULL;
+    }
+
   __memalign_hook = old_memalign_hook;
   if (old_memalign_hook != NULL)
     block = (*old_memalign_hook) (alignment, slop + size + 1, caller);
@@ -276,6 +290,12 @@ reallochook (__ptr_t ptr, __malloc_size_t size, const __ptr_t caller)
   if (pedantic)
     mcheck_check_all ();
 
+  if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
+    {
+      __set_errno (ENOMEM);
+      return NULL;
+    }
+
   if (ptr)
     {
       hdr = ((struct hdr *) ptr) - 1;