https://bugs.freedesktop.org/show_bug.cgi?id=76745
int strv_push(char ***l, char *value) {
char **c;
int strv_push(char ***l, char *value) {
char **c;
if (!value)
return 0;
n = strv_length(*l);
if (!value)
return 0;
n = strv_length(*l);
- c = realloc(*l, sizeof(char*) * (n + 2));
+
+ /* increase and check for overflow */
+ m = n + 2;
+ if (m < n)
+ return -ENOMEM;
+
+ c = realloc(*l, sizeof(char*) * (size_t) m);
int strv_push_prepend(char ***l, char *value) {
char **c;
int strv_push_prepend(char ***l, char *value) {
char **c;
if (!value)
return 0;
n = strv_length(*l);
if (!value)
return 0;
n = strv_length(*l);
+
+ /* increase and check for overflow */
+ m = n + 2;
+ if (m < n)
+ return -ENOMEM;
+
+ c = new(char*, m);