* lib/memmem.c (knuth_morris_pratt): Check for size_t overflow

when multiplying M by sizeof (size_t).

diff --git a/ChangeLog b/ChangeLog
index 364a429f2fcec1c8b88e61082d5a81f7304c836d..ada100e7e29b252bd65de3fafedc3c8bd6fd16c5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-12-29  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * lib/memmem.c (knuth_morris_pratt): Check for size_t overflow
+       when multiplying M by sizeof (size_t).
+
 2007-12-10  Martin Lambers <marlam@marlam.de>
 
        Override getpagesize on mingw.

diff --git a/lib/memmem.c b/lib/memmem.c
index 58f95f73b1068873b0eb5b2db6af8519812257e8..b7f3e12c6cbba2989019250c9ad188a6685d8e36 100644 (file)
--- a/lib/memmem.c
+++ b/lib/memmem.c
@@ -39,7 +39,10 @@ knuth_morris_pratt (const char *haystack, const char *last_haystack,
                     const char **resultp)
 {
   /* Allocate the table.  */
-  size_t *table = (size_t *) malloca (m * sizeof (size_t));
+  size_t *table;
+  if ((size_t) -1 / sizeof (size_t) < m)
+    return false;
+  table = (size_t *) malloca (m * sizeof (size_t));
   if (table == NULL)
     return false;
   /* Fill the table.