file/file-4.20-CVE-2007-2799.dif

24 lines
617 B
Plaintext

--- src/funcs.c
+++ src/funcs.c 2007-05-24 14:15:36.218013250 +0200
@@ -26,7 +26,7 @@
*/
#include "file.h"
#include "magic.h"
-#include <assert.h>
+#include <limits.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
@@ -247,7 +247,10 @@ file_getbuffer(struct magic_set *ms)
len = ms->o.size - ms->o.left;
/* * 4 is for octal representation, + 1 is for NUL */
psize = len * 4 + 1;
- assert(psize > len);
+ if (len > (ULONG_MAX - 1) / 4) {
+ file_oomem(ms, len);
+ return NULL;
+ }
if (ms->o.psize < psize) {
if ((pbuf = realloc(ms->o.pbuf, psize)) == NULL) {
file_oomem(ms, psize);