diff options
author | dgp <dgp@noemail.net> | 2009-09-29 04:43:58 (GMT) |
---|---|---|
committer | dgp <dgp@noemail.net> | 2009-09-29 04:43:58 (GMT) |
commit | e99a89b32beee29126eb6c304c39a4575de62316 (patch) | |
tree | cfb2df62951bf644dae366c44a8ebfca3ca41cb2 /generic/tclThreadAlloc.c | |
parent | 3bebc4273f6effec997a4698859e0c7c49b72c32 (diff) | |
download | tcl-e99a89b32beee29126eb6c304c39a4575de62316.zip tcl-e99a89b32beee29126eb6c304c39a4575de62316.tar.gz tcl-e99a89b32beee29126eb6c304c39a4575de62316.tar.bz2 |
* generic/tclAlloc.c: Cleaned up various routines in the
* generic/tclCkalloc.c: call stacks for memory allocation to
* generic/tclInt.h: guarantee that any size values computed
* generic/tclThreadAlloc.c: are within the domains of the routines
they get passed to. [Bugs 2557696 and 2557796].
FossilOrigin-Name: e6b0f11e96b073094e72b7c649ba9a7b7c90ac98
Diffstat (limited to 'generic/tclThreadAlloc.c')
-rwxr-xr-x | generic/tclThreadAlloc.c | 30 |
1 files changed, 27 insertions, 3 deletions
diff --git a/generic/tclThreadAlloc.c b/generic/tclThreadAlloc.c index 0850d66..e32ad84 100755 --- a/generic/tclThreadAlloc.c +++ b/generic/tclThreadAlloc.c @@ -11,7 +11,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclThreadAlloc.c,v 1.27 2008/03/20 09:49:16 dkf Exp $ + * RCS: @(#) $Id: tclThreadAlloc.c,v 1.27.2.1 2009/09/29 04:43:59 dgp Exp $ */ #include "tclInt.h" @@ -288,11 +288,23 @@ char * TclpAlloc( unsigned int reqSize) { - Cache *cachePtr = TclpGetAllocCache(); + Cache *cachePtr; Block *blockPtr; register int bucket; size_t size; + if (sizeof(int) >= sizeof(size_t)) { + /* An unsigned int overflow can also be a size_t overflow */ + const size_t zero = 0; + const size_t max = ~zero; + + if (((size_t) reqSize) > max - sizeof(Block) - RCHECK) { + /* Requested allocation exceeds memory */ + return NULL; + } + } + + cachePtr = TclpGetAllocCache(); if (cachePtr == NULL) { cachePtr = GetCache(); } @@ -414,7 +426,7 @@ TclpRealloc( char *ptr, unsigned int reqSize) { - Cache *cachePtr = TclpGetAllocCache(); + Cache *cachePtr; Block *blockPtr; void *newPtr; size_t size, min; @@ -424,6 +436,18 @@ TclpRealloc( return TclpAlloc(reqSize); } + if (sizeof(int) >= sizeof(size_t)) { + /* An unsigned int overflow can also be a size_t overflow */ + const size_t zero = 0; + const size_t max = ~zero; + + if (((size_t) reqSize) > max - sizeof(Block) - RCHECK) { + /* Requested allocation exceeds memory */ + return NULL; + } + } + + cachePtr = TclpGetAllocCache(); if (cachePtr == NULL) { cachePtr = GetCache(); } |