diff options
| author | christos <christos@NetBSD.org> | 2001-05-03 15:35:12 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2001-05-03 15:35:12 +0000 |
| commit | fa27739cb410bad378f390ca841b470c80c4e5c3 (patch) | |
| tree | f25936b986e164c81ff5cc278f83d15ad43b0551 /lib/libc/stdlib | |
| parent | dadbb7e784b928fe7a80c6534f7ceb2943f608d5 (diff) | |
PR/12810: Chris ?: malloc core-dumps when given large number as the argument.
This is because integer overflow occurs in the computation of the size of
the page directory array. We now detect that, and return ENOMEM.
Diffstat (limited to 'lib/libc/stdlib')
| -rw-r--r-- | lib/libc/stdlib/malloc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c index 38c876975a3..a88c3b91d23 100644 --- a/lib/libc/stdlib/malloc.c +++ b/lib/libc/stdlib/malloc.c @@ -1,4 +1,4 @@ -/* $NetBSD: malloc.c,v 1.36 2001/02/19 22:22:17 cgd Exp $ */ +/* $NetBSD: malloc.c,v 1.37 2001/05/03 15:35:12 christos Exp $ */ /* * ---------------------------------------------------------------------------- @@ -334,6 +334,13 @@ extend_pgdir(size_t idx) struct pginfo **new, **old; size_t newlen, oldlen; + /* check for overflow */ + if ((((~(1UL << ((sizeof(size_t) * NBBY) - 1)) / sizeof(*page_dir)) + 1) + + (malloc_pagesize / sizeof *page_dir)) < idx) { + errno = ENOMEM; + return 0; + } + /* Make it this many pages */ newlen = pageround(idx * sizeof *page_dir) + malloc_pagesize; |
