From e703d8a2f7bc1e24f37faa7fb40bc1ddde810a4f Mon Sep 17 00:00:00 2001
From: jwang <joshua.wang@getcruise.com>
Date: Fri, 24 Aug 2018 15:50:55 -0700
Subject: [PATCH] adding int overflow checks to vrefbuffer

---
 src/vrefbuffer.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/vrefbuffer.c b/src/vrefbuffer.c
index 28347476..4734b0ff 100644
--- a/src/vrefbuffer.c
+++ b/src/vrefbuffer.c
@@ -43,6 +43,10 @@ bool msgpack_vrefbuffer_init(msgpack_vrefbuffer* vbuf,
     vbuf->end   = array + nfirst;
     vbuf->array = array;
 
+    if((sizeof(msgpack_vrefbuffer_chunk) + chunk_size) < chunk_size){
+        return false;
+    }
+
     chunk = (msgpack_vrefbuffer_chunk*)malloc(
             sizeof(msgpack_vrefbuffer_chunk) + chunk_size);
     if(chunk == NULL) {
@@ -135,6 +139,9 @@ int msgpack_vrefbuffer_append_copy(msgpack_vrefbuffer* vbuf,
             sz = len;
         }
 
+        if((sizeof(msgpack_vrefbuffer_chunk) + sz) < sz){
+            return -1;
+        }
         chunk = (msgpack_vrefbuffer_chunk*)malloc(
                 sizeof(msgpack_vrefbuffer_chunk) + sz);
         if(chunk == NULL) {
@@ -165,6 +172,10 @@ int msgpack_vrefbuffer_migrate(msgpack_vrefbuffer* vbuf, msgpack_vrefbuffer* to)
 {
     size_t sz = vbuf->chunk_size;
 
+    if((sizeof(msgpack_vrefbuffer_chunk) + sz) < sz){
+        return -1;
+    }
+
     msgpack_vrefbuffer_chunk* empty = (msgpack_vrefbuffer_chunk*)malloc(
             sizeof(msgpack_vrefbuffer_chunk) + sz);
     if(empty == NULL) {