From c579ab1c8bc07102a08a12b7e8f1ab5f0e8b0323 Mon Sep 17 00:00:00 2001 From: cremno Date: Wed, 29 Apr 2015 17:00:35 +0200 Subject: always define SIZE_ERROR_MUL() macro Previously there wasn't a way to trigger the useful definition, but it is needed and that in every case to check for integer overflow due to multiplication and faulty/modified binary files. Also change existing code to a calloc()-like parameter order. --- src/load.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) (limited to 'src/load.c') diff --git a/src/load.c b/src/load.c index 9961bca6c..93b9efcd4 100644 --- a/src/load.c +++ b/src/load.c @@ -24,11 +24,7 @@ #define FLAG_SRC_MALLOC 1 #define FLAG_SRC_STATIC 0 -#if SIZE_MAX < UINT32_MAX -# define SIZE_ERROR_MUL(x, y) ((x) > SIZE_MAX / (y)) -#else -# define SIZE_ERROR_MUL(x, y) (0) -#endif +#define SIZE_ERROR_MUL(nmemb, size) ((nmemb) > SIZE_MAX / (size)) static size_t skip_padding(const uint8_t *buf) @@ -77,7 +73,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag src += skip_padding(src); if (irep->ilen > 0) { - if (SIZE_ERROR_MUL(sizeof(mrb_code), irep->ilen)) { + if (SIZE_ERROR_MUL(irep->ilen, sizeof(mrb_code))) { return NULL; } if ((flags & FLAG_SRC_MALLOC) == 0 && @@ -111,7 +107,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag plen = (size_t)bin_to_uint32(src); /* number of pool */ src += sizeof(uint32_t); if (plen > 0) { - if (SIZE_ERROR_MUL(sizeof(mrb_value), plen)) { + if (SIZE_ERROR_MUL(plen, sizeof(mrb_value))) { return NULL; } irep->pool = (mrb_value*)mrb_malloc(mrb, sizeof(mrb_value) * plen); @@ -156,7 +152,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, size_t *len, uint8_t flag irep->slen = (size_t)bin_to_uint32(src); /* syms length */ src += sizeof(uint32_t); if (irep->slen > 0) { - if (SIZE_ERROR_MUL(sizeof(mrb_sym), irep->slen)) { + if (SIZE_ERROR_MUL(irep->slen, sizeof(mrb_sym))) { return NULL; } irep->syms = (mrb_sym *)mrb_malloc(mrb, sizeof(mrb_sym) * irep->slen); -- cgit v1.2.3