rik/nanopb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add just-to-be-sure check to allocate_field().

Browse Source 
This check will help to detect bugs earlier, and is quite lightweight
compared to malloc() anyway.
This commit is contained in:
Petteri Aimonen
2014-09-08 17:33:05 +03:00
parent 33585924de
commit cc1c3a7963
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pb_decode.c
View File

@@ -482,11 +482,15 @@ static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t
{ {
void *ptr = *(void**)pData; void *ptr = *(void**)pData;
if (data_size == 0 || array_size == 0)
PB_RETURN_ERROR(stream, "invalid size");
/* Check for multiplication overflows. /* Check for multiplication overflows.
* This code avoids the costly division if the sizes are small enough. * This code avoids the costly division if the sizes are small enough.
* Multiplication is safe as long as only half of bits are set * Multiplication is safe as long as only half of bits are set
* in either multiplicand. * in either multiplicand.
*/ */
{
const size_t check_limit = (size_t)1 << (sizeof(size_t) * 4); const size_t check_limit = (size_t)1 << (sizeof(size_t) * 4);
if (data_size >= check_limit || array_size >= check_limit) if (data_size >= check_limit || array_size >= check_limit)
{ {
@@ -496,6 +500,7 @@ static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t
PB_RETURN_ERROR(stream, "size too large"); PB_RETURN_ERROR(stream, "size too large");
} }
} }
}
/* Allocate new or expand previous allocation */ /* Allocate new or expand previous allocation */
/* Note: on failure the old pointer will remain in the structure, /* Note: on failure the old pointer will remain in the structure,