diff options
author | Ondřej Bílka <neleai@seznam.cz> | 2015-07-11 17:44:10 +0200 |
---|---|---|
committer | Aurelien Jarno <aurelien@aurel32.net> | 2016-01-29 12:15:52 +0100 |
commit | 43f189b0032fbce67fc0c0f4e122e917cd232670 (patch) | |
tree | 538d24421380d7055ff7e85c37cbd98d9a33c800 /misc | |
parent | a73a62562a198072ab417e28d4c0315a78c49cfe (diff) | |
download | glibc-43f189b0032fbce67fc0c0f4e122e917cd232670.tar.gz |
Handle overflow in __hcreate_r
Hi,
As in bugzilla entry there is overflow in hsearch when looking for prime
number as SIZE_MAX - 1 is divisible by 5. We fix that by rejecting large
inputs before looking for prime.
* misc/hsearch_r.c (__hcreate_r): Handle overflow.
(cherry picked from commit 2f5c1750558fe64bac361f52d6827ab1bcfe52bc)
Diffstat (limited to 'misc')
-rw-r--r-- | misc/hsearch_r.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/misc/hsearch_r.c b/misc/hsearch_r.c index 9f55e845cf..559df29cf7 100644 --- a/misc/hsearch_r.c +++ b/misc/hsearch_r.c @@ -19,7 +19,7 @@ #include <errno.h> #include <malloc.h> #include <string.h> - +#include <stdint.h> #include <search.h> /* [Aho,Sethi,Ullman] Compilers: Principles, Techniques and Tools, 1986 @@ -73,6 +73,13 @@ __hcreate_r (nel, htab) return 0; } + if (nel >= SIZE_MAX / sizeof (_ENTRY)) + { + __set_errno (ENOMEM); + return 0; + } + + /* There is still another table active. Return with error. */ if (htab->table != NULL) return 0; |