diff options
author | Leon Scroggins III <scroggo@google.com> | 2017-03-13 14:23:58 -0400 |
---|---|---|
committer | mse1969 <mse1969@posteo.de> | 2017-05-24 21:34:07 +0200 |
commit | 3923f809b866e06e79a3d2003c68d45be8461f1b (patch) | |
tree | b6eb6e172c3bd5bd3446a279379e198b007f48f4 /openbsd-reallocarray.c | |
parent | 9b8f8602a74a943ddc356bb11c55b4998b2b386d (diff) | |
download | android_external_giflib-cm-13.0.tar.gz android_external_giflib-cm-13.0.tar.bz2 android_external_giflib-cm-13.0.zip |
Update GIFLIB to 5.1.4 DO NOT MERGEreplicant-6.0-0002cm-13.0
Bug:34697653
Also include <limits.h> in openbsd-reallocarray.c, which is where
Android defines SIZE_MAX.
Preserve Android modification in egif_lib.c, which changed
"S_IREAD | S_IWRITE" to "S_IRUSR | S_IWUSR"
AOSP-Change-Id: If19d3f071fd96afa2d37fe08d196c5042856c41b
(cherry picked from commit 7eb1d41f601998ea9be3e7c2034b262ff263b862)
CVE-2015-7555
Change-Id: Ie471001b442ee93a0072ba7292e425be580a4752
Diffstat (limited to 'openbsd-reallocarray.c')
-rw-r--r-- | openbsd-reallocarray.c | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/openbsd-reallocarray.c b/openbsd-reallocarray.c new file mode 100644 index 0000000..41a3326 --- /dev/null +++ b/openbsd-reallocarray.c @@ -0,0 +1,39 @@ +/* $OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $ */ +/* + * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include <sys/types.h> +#include <errno.h> +#include <stdint.h> +#include <stdlib.h> +#include <limits.h> + +/* + * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX + * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW + */ +#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4)) + +void * +reallocarray(void *optr, size_t nmemb, size_t size) +{ + if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && + nmemb > 0 && SIZE_MAX / nmemb < size) { + errno = ENOMEM; + return NULL; + } + return realloc(optr, size * nmemb); +} |