sfeed

commit a811215d22dd40b938021b9f41daf315ac11e685
parent 0326a6b837a7e5bb490360a7cdb0225947cee166
Author: Hiltjo Posthuma <hiltjo@codemadness.org>
Date:   Sat, 12 Oct 2019 14:01:17 +0200

string_append: check for addition and multiplication overflow

This could overflow / wrap the buffer.

Note: SIZE_MAX is defined in POSIX to atleast 65535.

On most platforms on 64-bit this is 0xffffffffffffffffUL bytes.

Diffstat:
M
sfeed.c
 | 
14
++++++++++++--

1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/sfeed.c b/sfeed.c
@@ -250,8 +250,12 @@ string_buffer_realloc(String *s, size_t newlen)
 {
 	size_t alloclen;
 
-	for (alloclen = 64; alloclen <= newlen; alloclen *= 2)
-		;
+	if (newlen > SIZE_MAX / 2) {
+		alloclen = SIZE_MAX;
+	} else {
+		for (alloclen = 64; alloclen <= newlen; alloclen *= 2)
+			;
+	}
 	if (!(s->data = realloc(s->data, alloclen)))
 		err(1, "realloc");
 	s->bufsiz = alloclen;
@@ -262,6 +266,12 @@ string_append(String *s, const char *data, size_t len)
 {
 	if (!len)
 		return;
+
+	if (s->len >= SIZE_MAX - len) {
+		errno = EOVERFLOW;
+		err(1, "realloc");
+	}
+
 	/* check if allocation is necessary, don't shrink buffer,
 	 * should be more than bufsiz of course. */
 	if (s->len + len >= s->bufsiz)