The over flow check for nmemb * bytes in debug_calloc is incorrect,
use the builtin overflow functions to check for multiplication and
addition overflow.
Change-Id: I3f1c13102621bc5380be1f69caa88dba2118f3cb
return g_dispatch->calloc(nmemb, bytes);
}
- size_t size = nmemb * bytes;
+ size_t size;
+ if (__builtin_mul_overflow(nmemb, bytes, &size)) {
+ // Overflow
+ errno = ENOMEM;
+ return nullptr;
+ }
+
if (size == 0) {
size = 1;
}
- size_t real_size = size + g_debug->extra_bytes();
- if (real_size < bytes || real_size < nmemb) {
+ size_t real_size;
+ if (__builtin_add_overflow(size, g_debug->extra_bytes(), &real_size)) {
// Overflow.
errno = ENOMEM;
return nullptr;
ASSERT_TRUE(pointer == nullptr);
ASSERT_EQ(ENOMEM, errno);
+ const size_t size_t_bits = sizeof(size_t) * 8;
+ const size_t sqrt_size_t = 1ULL << (size_t_bits/2);
+ pointer = debug_calloc(sqrt_size_t + 1, sqrt_size_t);
+ ASSERT_TRUE(pointer == nullptr);
+ ASSERT_EQ(ENOMEM, errno);
+
pointer = debug_realloc(nullptr, SIZE_MAX);
ASSERT_TRUE(pointer == nullptr);
ASSERT_EQ(ENOMEM, errno);