Author: ache
Date: Tue Mar 9 21:06:17 2010
New Revision: 204928
URL: http://svn.freebsd.org/changeset/base/204928
Log:
Add SIZE_MAX overflow check
Modified:
head/usr.bin/comm/comm.c
Modified: head/usr.bin/comm/comm.c
==============================================================================
--- head/usr.bin/comm/comm.c Tue Mar 9 21:06:01 2010 (r204927)
+++ head/usr.bin/comm/comm.c Tue Mar 9 21:06:17 2010 (r204928)
@@ -201,6 +201,8 @@ convert(const char *str)
if ((n = mbstowcs(NULL, str, 0)) == (size_t)-1)
return (NULL);
+ if (SIZE_MAX / sizeof(*buf) < n + 1)
+ errx(1, "conversion buffer length overflow");
if ((buf = malloc((n + 1) * sizeof(*buf))) == NULL)
err(1, "malloc");
if (mbstowcs(buf, str, n + 1) != n)
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
