6502/llvm-6502
1
0
Fork 0
mirror of https://github.com/c64scene-ar/llvm-6502.git synced 2024-12-13 20:32:21 +00:00
Code Issues Projects Releases Wiki Activity

Avoid integer overflows around realloc calls resulting in potential

Browse Source 
heap. Problem identified by Guido Vranken. Changes differ from original
OpenBSD sources by not depending on non-portable reallocarray.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228507 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Joerg Sonnenberger 2015-02-07 21:24:06 +00:00
parent 710e70bb70
commit 128482cfc4
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/Support/regcomp.c
View File

@ -49,6 +49,14 @@
#include "regcclass.h" #include "regcclass.h"
#include "regcname.h" #include "regcname.h"
#include "llvm/Config/config.h"
#if HAVE_STDINT_H
#include <stdint.h>
#else
/* Pessimistically bound memory use */
#define SIZE_MAX UINT_MAX
#endif
/* /*
* parse structure, passed up and down to avoid global variables and * parse structure, passed up and down to avoid global variables and
* other clumsinesses * other clumsinesses
@ -1069,6 +1077,8 @@ allocset(struct parse *p)
p->ncsalloc += CHAR_BIT; p->ncsalloc += CHAR_BIT;
nc = p->ncsalloc; nc = p->ncsalloc;
if (nc > SIZE_MAX / sizeof(cset))
goto nomem;
assert(nc % CHAR_BIT == 0); assert(nc % CHAR_BIT == 0);
nbytes = nc / CHAR_BIT * css; nbytes = nc / CHAR_BIT * css;
@ -1412,6 +1422,11 @@ enlarge(struct parse *p, sopno size)
if (p->ssize >= size) if (p->ssize >= size)
return; return;
if ((unsigned long)size > SIZE_MAX / sizeof(sop)) {
SETERROR(REG_ESPACE);
return;
}
sp = (sop *)realloc(p->strip, size*sizeof(sop)); sp = (sop *)realloc(p->strip, size*sizeof(sop));
if (sp == NULL) { if (sp == NULL) {
SETERROR(REG_ESPACE); SETERROR(REG_ESPACE);
@ -1428,6 +1443,12 @@ static void
stripsnug(struct parse *p, struct re_guts *g) stripsnug(struct parse *p, struct re_guts *g)
{ {
g->nstates = p->slen; g->nstates = p->slen;
if ((unsigned long)p->slen > SIZE_MAX / sizeof(sop)) {
g->strip = p->strip;
SETERROR(REG_ESPACE);
return;
}
g->strip = (sop *)realloc((char *)p->strip, p->slen * sizeof(sop)); g->strip = (sop *)realloc((char *)p->strip, p->slen * sizeof(sop));
if (g->strip == NULL) { if (g->strip == NULL) {
SETERROR(REG_ESPACE); SETERROR(REG_ESPACE);