Fix malloc and realloc overflow
If user requests a size >= 65532, adding the heap admin size overflows size. Fixes #2358.
This commit is contained in:
@@ -59,6 +59,11 @@ void* __fastcall__ realloc (void* block, register size_t size)
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Don't overflow! */
|
||||
if (size > 0xFFFF - HEAP_ADMIN_SPACE) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Make the internal used size from the given size */
|
||||
size += HEAP_ADMIN_SPACE;
|
||||
if (size < sizeof (struct freeblock)) {
|
||||
@@ -107,6 +112,3 @@ void* __fastcall__ realloc (void* block, register size_t size)
|
||||
}
|
||||
return newblock;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user