From 97569e154b80541cbad39d78231b7f360d4ff058 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 21 Oct 2014 14:01:28 +0200 Subject: [PATCH] strv: add an additional overflow check when enlarging strv()s https://bugs.freedesktop.org/show_bug.cgi?id=76745 --- src/shared/strv.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/src/shared/strv.c b/src/shared/strv.c index 0df978d23..efa648df8 100644 --- a/src/shared/strv.c +++ b/src/shared/strv.c @@ -380,13 +380,19 @@ char *strv_join_quoted(char **l) { int strv_push(char ***l, char *value) { char **c; - unsigned n; + unsigned n, m; if (!value) return 0; n = strv_length(*l); - c = realloc(*l, sizeof(char*) * (n + 2)); + + /* increase and check for overflow */ + m = n + 2; + if (m < n) + return -ENOMEM; + + c = realloc(*l, sizeof(char*) * (size_t) m); if (!c) return -ENOMEM; @@ -399,13 +405,19 @@ int strv_push(char ***l, char *value) { int strv_push_prepend(char ***l, char *value) { char **c; - unsigned n, i; + unsigned n, m, i; if (!value) return 0; n = strv_length(*l); - c = new(char*, n + 2); + + /* increase and check for overflow */ + m = n + 2; + if (m < n) + return -ENOMEM; + + c = new(char*, m); if (!c) return -ENOMEM; -- 2.30.2