summaryrefslogtreecommitdiff
path: root/lib/libc/stdlib
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2001-05-03 15:35:12 +0000
committerchristos <christos@NetBSD.org>2001-05-03 15:35:12 +0000
commitfa27739cb410bad378f390ca841b470c80c4e5c3 (patch)
treef25936b986e164c81ff5cc278f83d15ad43b0551 /lib/libc/stdlib
parentdadbb7e784b928fe7a80c6534f7ceb2943f608d5 (diff)
PR/12810: Chris ?: malloc core-dumps when given large number as the argument.
This is because integer overflow occurs in the computation of the size of the page directory array. We now detect that, and return ENOMEM.
Diffstat (limited to 'lib/libc/stdlib')
-rw-r--r--lib/libc/stdlib/malloc.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c
index 38c876975a3..a88c3b91d23 100644
--- a/lib/libc/stdlib/malloc.c
+++ b/lib/libc/stdlib/malloc.c
@@ -1,4 +1,4 @@
-/* $NetBSD: malloc.c,v 1.36 2001/02/19 22:22:17 cgd Exp $ */
+/* $NetBSD: malloc.c,v 1.37 2001/05/03 15:35:12 christos Exp $ */
/*
* ----------------------------------------------------------------------------
@@ -334,6 +334,13 @@ extend_pgdir(size_t idx)
struct pginfo **new, **old;
size_t newlen, oldlen;
+ /* check for overflow */
+ if ((((~(1UL << ((sizeof(size_t) * NBBY) - 1)) / sizeof(*page_dir)) + 1)
+ + (malloc_pagesize / sizeof *page_dir)) < idx) {
+ errno = ENOMEM;
+ return 0;
+ }
+
/* Make it this many pages */
newlen = pageround(idx * sizeof *page_dir) + malloc_pagesize;