From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 28 Sep 2016 10:15:34 +0200 Subject: [PATCH] aprintf: detect wrap-around when growing allocation On 32bit systems we could otherwise wrap around after 2GB and allocate 0 bytes and crash. CVE: CVE-2016-8618 Upstream-Status: Backport Bug: https://curl.haxx.se/docs/adv_20161102D.html Reported-by: Cure53 Signed-off-by: Sona Sarmadi --- lib/mprintf.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/mprintf.c b/lib/mprintf.c index dbedeaa..2c88aa8 100644 --- a/lib/mprintf.c +++ b/lib/mprintf.c @@ -1034,20 +1034,23 @@ static int alloc_addbyter(int output, FILE *data) } infop->alloc = 32; infop->len =0; } else if(infop->len+1 >= infop->alloc) { - char *newptr; + char *newptr = NULL; + size_t newsize = infop->alloc*2; - newptr = realloc(infop->buffer, infop->alloc*2); + /* detect wrap-around or other overflow problems */ + if(newsize > infop->alloc) + newptr = realloc(infop->buffer, newsize); if(!newptr) { infop->fail = 1; return -1; /* fail */ } infop->buffer = newptr; - infop->alloc *= 2; + infop->alloc = newsize; } infop->buffer[ infop->len ] = outc; infop->len++; -- 2.9.3