cperciva 2006-08-13 21:54:47 UTC
FreeBSD src repository
Modified files:
lib/libc/stdlib malloc.c
Log:
Correctly handle the case in calloc(num, size) where
(size_t)(num * size) == 0
but both num and size are nonzero.
Reported by: Ilja van Sprundel
Approved by: jasone
Security: Integer overflow; calloc was allocating 1 byte in
response to a request for a multiple of 2^32 (or 2^64)
bytes instead of returning NULL.
Revision Changes Path
1.134 +1 -1 src/lib/libc/stdlib/malloc.c
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
