From 086eed9d97b860b2c3484038d225a16e406c757d Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 28 Sep 2016 10:15:34 +0200 Subject: [PATCH] aprintf: detect wrap-around when growing allocation On 32bit systems we could otherwise wrap around after 2GB and allocate 0 bytes and crash. CVE-2016-8618 Bug: https://curl.haxx.se/docs/adv_20161102D.html Reported-by: Cure53 Upstream-commit: 8732ec40db652c53fa58cd13e2acb8eab6e40874 Signed-off-by: Kamil Dudka --- lib/mprintf.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/mprintf.c b/lib/mprintf.c index b6d9a9c..e47c10a 100644 --- a/lib/mprintf.c +++ b/lib/mprintf.c @@ -1011,16 +1011,19 @@ static int alloc_addbyter(int output, FILE *data) infop->len =0; } else if(infop->len+1 >= infop->alloc) { - char *newptr; + char *newptr = NULL; + size_t newsize = infop->alloc*2; - newptr = realloc(infop->buffer, infop->alloc*2); + /* detect wrap-around or other overflow problems */ + if(newsize > infop->alloc) + newptr = realloc(infop->buffer, newsize); if(!newptr) { infop->fail = 1; return -1; /* fail */ } infop->buffer = newptr; - infop->alloc *= 2; + infop->alloc = newsize; } infop->buffer[ infop->len ] = outc; -- 2.7.4