From f8587e2d50dad72d40453ac1191c539ee9e50381 Mon Sep 17 00:00:00 2001 From: Mans Rullgard Date: Wed, 24 Apr 2019 17:39:45 +0100 Subject: [PATCH 3/5] fix possible overflow in lsx_(re)valloc() size calculation (CVE-2019-8355) --- src/Makefile.am | 2 +- src/xmalloc.c | 10 ++++++++++ src/xmalloc.h | 5 +++-- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/src/xmalloc.c b/src/xmalloc.c index 56fe6944..72c9ea4d 100644 --- a/src/xmalloc.c +++ b/src/xmalloc.c @@ -57,6 +57,16 @@ void *lsx_calloc(size_t n, size_t size) return lsx_checkptr(calloc(n + !n, size + !size)); } +void *lsx_realloc_array(void *p, size_t n, size_t size) +{ + if (n > (size_t)-1 / size) { + lsx_fail("malloc size overflow"); + exit(2); + } + + return lsx_realloc(p, n * size); +} + char *lsx_strdup(const char *s) { return lsx_checkptr(strdup(s)); diff --git a/src/xmalloc.h b/src/xmalloc.h index 92ac64d9..21ff6630 100644 --- a/src/xmalloc.h +++ b/src/xmalloc.h @@ -25,11 +25,12 @@ LSX_RETURN_VALID void *lsx_malloc(size_t size); LSX_RETURN_VALID void *lsx_calloc(size_t n, size_t size); +LSX_RETURN_VALID void *lsx_realloc_array(void *p, size_t n, size_t size); LSX_RETURN_VALID char *lsx_strdup(const char *s); #define lsx_Calloc(v,n) v = lsx_calloc(n,sizeof(*(v))) #define lsx_memdup(p,s) ((p)? memcpy(lsx_malloc(s), p, s) : NULL) -#define lsx_valloc(v,n) v = lsx_malloc((n)*sizeof(*(v))) -#define lsx_revalloc(v,n) v = lsx_realloc(v, (n)*sizeof(*(v))) +#define lsx_valloc(v,n) v = lsx_realloc_array(NULL, n, sizeof(*(v))) +#define lsx_revalloc(v,n) v = lsx_realloc_array(v, n, sizeof(*(v))) #endif -- 2.20.1