16efc896b0
- backport patches from gc-7_2-hotfix-2 branch in lieu of 7.2c release - gc 7.2 final abi broken when changing several symbols to hidden (#825473) - gc: malloc() and calloc() overflows (CVE-2012-2673, #828881)
28 lines
1.0 KiB
Diff
28 lines
1.0 KiB
Diff
From 5591275f04b1b94395e38eeada745cd97bc8b613 Mon Sep 17 00:00:00 2001
|
|
From: Ivan Maidanski <ivmai@mail.ru>
|
|
Date: Fri, 8 Jun 2012 21:10:17 +0400
|
|
Subject: [PATCH 8/9] Fix CORD_cat_char_star to prevent SEGV in case of
|
|
out-of-memory
|
|
|
|
* cordbscs.c (CORD_cat_char_star): Check GC_MALLOC_ATOMIC result for
|
|
NULL (do OUT_OF_MEMORY in such case) to prevent SEGV.
|
|
---
|
|
cord/cordbscs.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/cord/cordbscs.c b/cord/cordbscs.c
|
|
index 924bf44..5128daf 100644
|
|
--- a/cord/cordbscs.c
|
|
+++ b/cord/cordbscs.c
|
|
@@ -188,6 +188,7 @@ CORD CORD_cat_char_star(CORD x, const char * y, size_t leny)
|
|
result_len = right_len + leny; /* length of new_right */
|
|
if (result_len <= SHORT_LIMIT) {
|
|
new_right = GC_MALLOC_ATOMIC(result_len + 1);
|
|
+ if (new_right == 0) OUT_OF_MEMORY;
|
|
memcpy(new_right, right, right_len);
|
|
memcpy(new_right + right_len, y, leny);
|
|
new_right[result_len] = '\0';
|
|
--
|
|
1.7.10.2
|
|
|