narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[pixbuf] Check for unsigned integer overflow on multiplication 

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/44/head
Michael Brown 2016-03-12 00:09:23 +00:00
parent 5a6ed90a00
commit 11396473f5
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/pixbuf.c
View File

@ -65,6 +65,10 @@ struct pixel_buffer * alloc_pixbuf ( unsigned int width, unsigned int height ) {
pixbuf->height = height; pixbuf->height = height;
pixbuf->len = ( width * height * sizeof ( uint32_t ) ); pixbuf->len = ( width * height * sizeof ( uint32_t ) );
/* Check for multiplication overflow */
if ( ( ( pixbuf->len / sizeof ( uint32_t ) ) / width ) != height )
goto err_overflow;
/* Allocate pixel data buffer */ /* Allocate pixel data buffer */
pixbuf->data = umalloc ( pixbuf->len ); pixbuf->data = umalloc ( pixbuf->len );
if ( ! pixbuf->data ) if ( ! pixbuf->data )
@ -73,6 +77,7 @@ struct pixel_buffer * alloc_pixbuf ( unsigned int width, unsigned int height ) {
return pixbuf; return pixbuf;
err_alloc_data: err_alloc_data:
err_overflow:
pixbuf_put ( pixbuf ); pixbuf_put ( pixbuf );
err_alloc_pixbuf: err_alloc_pixbuf:
return NULL; return NULL;