summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStanislav Malyshev <stas@php.net>2012-06-08 01:21:37 -0700
committerStanislav Malyshev <stas@php.net>2012-06-08 01:21:37 -0700
commitfc74503792b1ee92e4b813690890f3ed38fa3ad5 (patch)
treea0340002fee20fe8acdeae560fc43a3f9ed87998
parent7d04e0fb2ec8be9b1c4b16a9f0b4958f853597f1 (diff)
downloadphp-git-fc74503792b1ee92e4b813690890f3ed38fa3ad5.tar.gz
improve overflow checks
-rwxr-xr-xmain/streams/streams.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 43cb0104f3..dfd60940fc 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -2279,6 +2279,11 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_
if (vector_size == 0) {
vector_size = 10;
} else {
+ if(vector_size*2 < vector_size) {
+ /* overflow */
+ efree(vector);
+ return FAILURE;
+ }
vector_size *= 2;
}
vector = (char **) safe_erealloc(vector, vector_size, sizeof(char *), 0);
@@ -2287,11 +2292,6 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_
vector[nfiles] = estrdup(sdp.d_name);
nfiles++;
- if(vector_size < 10 || nfiles == 0) {
- /* overflow */
- efree(vector);
- return FAILURE;
- }
}
php_stream_closedir(stream);