From 54dd0ab31fe2b2168ba1a6180a0c05941fb54b3c Mon Sep 17 00:00:00 2001 From: Ulrich Drepper Date: Fri, 22 Jan 2010 09:33:01 -0800 Subject: regex: avoid internal re_realloc overflow --- posix/regex_internal.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'posix/regex_internal.c') diff --git a/posix/regex_internal.c b/posix/regex_internal.c index ff28e5fcb9..690ed8d8b7 100644 --- a/posix/regex_internal.c +++ b/posix/regex_internal.c @@ -133,7 +133,14 @@ re_string_realloc_buffers (re_string_t *pstr, int new_buf_len) #ifdef RE_ENABLE_I18N if (pstr->mb_cur_max > 1) { - wint_t *new_wcs = re_realloc (pstr->wcs, wint_t, new_buf_len); + wint_t *new_wcs; + + /* Avoid overflow in realloc. */ + const size_t max_object_size = MAX (sizeof (wint_t), sizeof (int)); + if (BE (SIZE_MAX / max_object_size < new_buf_len, 0)) + return REG_ESPACE; + + new_wcs = re_realloc (pstr->wcs, wint_t, new_buf_len); if (BE (new_wcs == NULL, 0)) return REG_ESPACE; pstr->wcs = new_wcs; -- cgit 1.4.1