diff options
| author | 2020-03-27 08:20:21 +0000 | |
|---|---|---|
| committer | 2020-03-27 08:20:21 +0000 | |
| commit | c7589f290773cdcf7d93c4b9204d59b22e0d2789 (patch) | |
| tree | 02fb931ced62ec8af44e6e87e12969601eb28614 /libs/binder/BufferedTextOutput.cpp | |
| parent | 03c860944bc3e0647f0bf8c476185ebd4ddf2b90 (diff) | |
| parent | af8f6cf3aba3398b36117dd3acce6f5a3c0610c6 (diff) | |
Merge "Fix addition/overflow checks." into qt-qpr1-dev am: af8f6cf3ab
Change-Id: I4f604cb104cc49b7e8f6612f1033a113faf51a48
Diffstat (limited to 'libs/binder/BufferedTextOutput.cpp')
| -rw-r--r-- | libs/binder/BufferedTextOutput.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libs/binder/BufferedTextOutput.cpp b/libs/binder/BufferedTextOutput.cpp index 856a178f58..8cf6097759 100644 --- a/libs/binder/BufferedTextOutput.cpp +++ b/libs/binder/BufferedTextOutput.cpp @@ -49,9 +49,10 @@ struct BufferedTextOutput::BufferState : public RefBase } status_t append(const char* txt, size_t len) { + if (len > SIZE_MAX - bufferPos) return NO_MEMORY; // overflow if ((len+bufferPos) > bufferSize) { + if ((len + bufferPos) > SIZE_MAX / 3) return NO_MEMORY; // overflow size_t newSize = ((len+bufferPos)*3)/2; - if (newSize < (len+bufferPos)) return NO_MEMORY; // overflow void* b = realloc(buffer, newSize); if (!b) return NO_MEMORY; buffer = (char*)b; |