[vlc-commits] memstream: handle overflow

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Tue Jul 16 22:49:12 2019 +0300| [cd9085186853ff87f13fb5a1cff42787b7639b63] | committer: Rémi Denis-Courmont

memstream: handle overflow

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=cd9085186853ff87f13fb5a1cff42787b7639b63
---

 src/text/memstream.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/text/memstream.c b/src/text/memstream.c
index 093a419cf8..292b3d602f 100644
--- a/src/text/memstream.c
+++ b/src/text/memstream.c
@@ -127,7 +127,13 @@ int vlc_memstream_close(struct vlc_memstream *ms)
 size_t vlc_memstream_write(struct vlc_memstream *ms, const void *ptr,
                            size_t len)
 {
-    char *base = realloc(ms->ptr, ms->length + len + 1u);
+    size_t newlen;
+
+    if (unlikely(add_overflow(ms->length, len, &newlen))
+     || unlikely(add_overflow(newlen, 1, &newlen)))
+        goto error;
+
+    char *base = realloc(ms->ptr, newlen);
     if (unlikely(base == NULL))
         goto error;