From e989260658cab39b391ef9dab1380024365332c8 Mon Sep 17 00:00:00 2001 From: Bruno Haible Date: Thu, 30 Oct 2003 14:09:04 +0000 Subject: [PATCH] Check for overflow when converting from size_t to 'int'. --- lib/ChangeLog | 6 ++++++ lib/vasprintf.c | 13 ++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/lib/ChangeLog b/lib/ChangeLog index 70573a8e17..a0b1b95f1c 100644 --- a/lib/ChangeLog +++ b/lib/ChangeLog @@ -1,3 +1,9 @@ +2003-10-30 Paul Eggert + Bruno Haible + + * vasprintf.c: Include , . + (vasprintf): Fail if the resulting length doesn't fit in an 'int'. + 2003-10-29 Paul Eggert * xalloc.h (xalloc_oversized): Now a macro, not a function, diff --git a/lib/vasprintf.c b/lib/vasprintf.c index 7c8f212d72..bda9aa1b0f 100644 --- a/lib/vasprintf.c +++ b/lib/vasprintf.c @@ -1,5 +1,5 @@ /* Formatted output to strings. - Copyright (C) 1999, 2002 Free Software Foundation, Inc. + Copyright (C) 1999, 2002-2003 Free Software Foundation, Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -22,6 +22,9 @@ /* Specification. */ #include "vasprintf.h" +#include +#include + #include "vasnprintf.h" int @@ -31,6 +34,14 @@ vasprintf (char **resultp, const char *format, va_list args) char *result = vasnprintf (NULL, &length, format, args); if (result == NULL) return -1; + if (length > INT_MAX) + { + /* We could produce such a big string, but can't return its length + as an 'int'. */ + free (result); + return -1; + } + *resultp = result; /* Return the number of resulting bytes, excluding the trailing NUL. */ return length; -- 2.30.2