details: http://hg.nginx.org/njs/rev/8ab908b0f226
branches:
changeset: 628:8ab908b0f226
user: Dmitry Volyntsev <xeioex@nginx.com>
date: Fri Oct 19 20:55:38 2018 +0300
description:
Handling int overflow in njs_array_alloc() on 32bit archs.

diffstat:

njs/njs_array.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)

diffs (25 lines):

diff -r 084484ab232b -r 8ab908b0f226 njs/njs_array.c
--- a/njs/njs_array.c Fri Oct 19 20:55:33 2018 +0300
+++ b/njs/njs_array.c Fri Oct 19 20:55:38 2018 +0300
@@ -109,7 +109,7 @@ static njs_ret_t njs_array_prototype_sor
nxt_noinline njs_array_t *
njs_array_alloc(njs_vm_t *vm, uint32_t length, uint32_t spare)
{
- size_t size;
+ uint64_t size;
njs_array_t *array;

array = nxt_mem_cache_alloc(vm->mem_cache_pool, sizeof(njs_array_t));
@@ -117,9 +117,9 @@ njs_array_alloc(njs_vm_t *vm, uint32_t l
goto memory_error;
}

- size = (size_t) length + spare;
-
- if (nxt_slow_path(size * sizeof(njs_value_t) < size)) {
+ size = (uint64_t) length + spare;
+
+ if (nxt_slow_path((size * sizeof(njs_value_t)) >= 0xffffffff)) {
goto memory_error;
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel