diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2021-02-28 21:48:57 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2021-02-28 21:50:32 +0000 |
| commit | e37579c13c466b0704b2c3ce17edd2ecf0cc9f36 (patch) | |
| tree | b6ee44f49d9a68126e611ff93c0543a7aaf627ad /Str.c | |
| parent | Prevent unintentional integer overflow in libwc (diff) | |
| download | w3m-e37579c13c466b0704b2c3ce17edd2ecf0cc9f36.tar.gz w3m-e37579c13c466b0704b2c3ce17edd2ecf0cc9f36.zip | |
Prevent zero size allocation in Str.cv0.5.3+git20210102+deb11u0.5master-deb11
Diffstat (limited to 'Str.c')
| -rw-r--r-- | Str.c | 8 |
1 files changed, 4 insertions, 4 deletions
@@ -69,7 +69,7 @@ Strnew_charp(const char *p) return Strnew(); x = GC_MALLOC(sizeof(struct _Str)); n = strlen(p) + 1; - if (n < 0 || n > STR_SIZE_MAX) + if (n <= 0 || n > STR_SIZE_MAX) n = STR_SIZE_MAX; x->ptr = GC_MALLOC_ATOMIC(n); x->area_size = n; @@ -206,14 +206,14 @@ Strcat_charp_n(Str x, const char *y, int n) if (n < 0) n = STR_SIZE_MAX - 1; newlen = x->length + n + 1; - if (newlen < 0 || newlen > STR_SIZE_MAX) { + if (newlen <= 0 || newlen > STR_SIZE_MAX) { newlen = STR_SIZE_MAX; n = newlen - x->length - 1; } if (x->area_size < newlen) { char *old = x->ptr; newlen += newlen / 2; - if (newlen < 0 || newlen > STR_SIZE_MAX) + if (newlen <= 0 || newlen > STR_SIZE_MAX) newlen = STR_SIZE_MAX; x->ptr = GC_MALLOC_ATOMIC(newlen); x->area_size = newlen; @@ -259,7 +259,7 @@ Strgrow(Str x) newlen = x->area_size + x->area_size / 5; if (newlen == x->area_size) newlen += 2; - if (newlen < 0 || newlen > STR_SIZE_MAX) { + if (newlen <= 0 || newlen > STR_SIZE_MAX) { newlen = STR_SIZE_MAX; if (x->length + 1 >= newlen) x->length = newlen - 2; |