romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 12:13:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_urlglob: make multiply() bail out on negative values

Browse source 
- Does not work correctly with negative values
- use __builtin_mul_overflow() on gcc

Reported-by: Torben Dury
Closes #12102
This commit is contained in:
Daniel Stenberg 2023-10-13 00:13:23 +02:00
parent 732d8ef758
commit 8a45a495af
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/tool_urlglob.c
View file

@ -66,13 +66,22 @@ static CURLcode glob_fixed(struct URLGlob *glob, char *fixed, size_t len)
*/
static int multiply(curl_off_t *amount, curl_off_t with)
{
curl_off_t sum = *amount * with;
if(!with) {
*amount = 0;
return 0;
curl_off_t sum;
DEBUGASSERT(*amount >= 0);
DEBUGASSERT(with >= 0);
if((with <= 0) || (*amount <= 0)) {
sum = 0;
}
else {
#ifdef __GNUC__
if(__builtin_mul_overflow(*amount, with, &sum))
return 1;
#else
sum = *amount * with;
if(sum/with != *amount)
return 1; /* didn't fit, bail out */
#endif
}
if(sum/with != *amount)
return 1; /* didn't fit, bail out */
*amount = sum;
return 0;
}