admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

always define SIZE_ERROR_MUL() macro

Browse Source 
Previously there wasn't a way to trigger the useful definition, but it
is needed and that in every case to check for integer overflow due to
multiplication and faulty/modified binary files.

Also change existing code to a calloc()-like parameter order.
This commit is contained in:
cremno
2015-04-29 17:00:35 +02:00
parent aaf2615ed6
commit c579ab1c8b
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/load.c
+4 -8
View File
@@ -24,11 +24,7 @@
#define FLAG_SRC_MALLOC 1
#define FLAG_SRC_STATIC 0
#if SIZE_MAX < UINT32_MAX
# define SIZE_ERROR_MUL(x, y) ((x) > SIZE_MAX / (y))
#else
# define SIZE_ERROR_MUL(x, y) (0)
#endif
#define SIZE_ERROR_MUL(nmemb, size) ((nmemb) > SIZE_MAX / (size))
static size_t
skip_padding(const uint8_t *buf)
@@ -77,7 +73,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag
src += skip_padding(src);
if (irep->ilen > 0) {
if (SIZE_ERROR_MUL(sizeof(mrb_code), irep->ilen)) {
if (SIZE_ERROR_MUL(irep->ilen, sizeof(mrb_code))) {
return NULL;
}
if ((flags & FLAG_SRC_MALLOC) == 0 &&
@@ -111,7 +107,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag
plen = (size_t)bin_to_uint32(src); /* number of pool */
src += sizeof(uint32_t);
if (plen > 0) {
if (SIZE_ERROR_MUL(sizeof(mrb_value), plen)) {
if (SIZE_ERROR_MUL(plen, sizeof(mrb_value))) {
return NULL;
}
irep->pool = (mrb_value*)mrb_malloc(mrb, sizeof(mrb_value) * plen);
@@ -156,7 +152,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag
irep->slen = (size_t)bin_to_uint32(src); /* syms length */
src += sizeof(uint32_t);
if (irep->slen > 0) {
if (SIZE_ERROR_MUL(sizeof(mrb_sym), irep->slen)) {
if (SIZE_ERROR_MUL(irep->slen, sizeof(mrb_sym))) {
return NULL;
}
irep->syms = (mrb_sym *)mrb_malloc(mrb, sizeof(mrb_sym) * irep->slen);