romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 20:13:07 +03:00
Code Issues Projects Releases Packages Wiki Activity

bufq: add integer overflow checks before chunk allocations

Browse source 
Closes #18112
This commit is contained in:
Cole Leavitt 2025-07-30 22:19:01 -07:00 • committed by Daniel Stenberg
parent 37913c01a5
commit 4108d11008
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/bufq.c
View file

@ -174,6 +174,12 @@ static CURLcode bufcp_take(struct bufc_pool *pool,
return CURLE_OK;
}
/* Check for integer overflow before allocation */
if(pool->chunk_size > SIZE_MAX - sizeof(*chunk)) {
*pchunk = NULL;
return CURLE_OUT_OF_MEMORY;
}
chunk = calloc(1, sizeof(*chunk) + pool->chunk_size);
if(!chunk) {
*pchunk = NULL;
@ -302,6 +308,11 @@ static struct buf_chunk *get_spare(struct bufq *q)
return chunk;
}
else {
/* Check for integer overflow before allocation */
if(q->chunk_size > SIZE_MAX - sizeof(*chunk)) {
return NULL;
}
chunk = calloc(1, sizeof(*chunk) + q->chunk_size);
if(!chunk)
return NULL;