OSDN Git Service

malloc: handle size overflows in realloc()
authorMike Frysinger <vapier@gentoo.org>
Thu, 15 Oct 2009 23:47:12 +0000 (19:47 -0400)
committerMike Frysinger <vapier@gentoo.org>
Thu, 15 Oct 2009 23:47:12 +0000 (19:47 -0400)
commit07e0ce9fa7f428720bee9decb5d0bb368108d93f
treef5b9628791c8b698b5b1f6901971aef7829f882c
parent3729a87541cdc87e5d1de09f49f39c0eec83a89f
malloc: handle size overflows in realloc()

The malloc() code checks the incoming size to make sure the header
adjustment doesn't cause overflow in the size storage.  Add the same
check to realloc() to catch stupid stuff like realloc(..., -1).

Reported-by: James Coleman <james.coleman@ubicom.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
libc/stdlib/malloc/realloc.c