romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-19 11:21:20 +03:00
Code Issues Projects Releases Packages Wiki Activity

multi.c: fix possible invalid memory access in case nfds overflows

Browse source 
ufds might not be allocated in case nfds overflows to zero while
extra_nfds is still non-zero. udfs is then accessed within the
extra_nfds-based for loop.
This commit is contained in:
Marc Hoersken 2014-04-19 16:02:14 +02:00
parent 549b4a659a
commit ee6791128f
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/multi.c
View file

@ -828,7 +828,7 @@ CURLMcode curl_multi_wait(CURLM *multi_handle,
curlfds = nfds; /* number of internal file descriptors */
nfds += extra_nfds; /* add the externally provided ones */
if(nfds) {
if(nfds || extra_nfds) {
ufds = malloc(nfds * sizeof(struct pollfd));
if(!ufds)
return CURLM_OUT_OF_MEMORY;