diff options
| author |   Ulrich Drepper <drepper@redhat.com> | 2007-07-04 18:06:39 +0000 |
|---|---|---|
| committer | Ulrich Drepper <drepper@redhat.com> | 2007-07-04 18:06:39 +0000 |
| commit | 1311e86e432fde7e3ea44eb33e8b8472f710dd61 (patch) | |
| tree | e15c0dd38128a7454e4c48010b9d7b255f8d8e28 /elf/dl-sysdep.c | |
| parent | [BZ #4702] (diff) | |
| download | glibc-1311e86e432fde7e3ea44eb33e8b8472f710dd61.tar.gz glibc-1311e86e432fde7e3ea44eb33e8b8472f710dd61.tar.bz2 glibc-1311e86e432fde7e3ea44eb33e8b8472f710dd61.zip | |
* elf/dl-sysdep.c (_dl_important_hwcaps): Add integer overflow check.
* elf/dl-minimal.c (__libc_memalign): Likewise. Handle malloc (0).
Return NULL if mmap failed instead of asserting it does not.
(calloc): Check for integer overflow.
* elf/dl-minimal.c (__strtoul_internal): Fix parsing of numbers bigger
than LONG_MAX / 10.
Diffstat (limited to 'elf/dl-sysdep.c')
| -rw-r--r-- | elf/dl-sysdep.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/elf/dl-sysdep.c b/elf/dl-sysdep.c index d06ce1754e..ec3f0e3474 100644 --- a/elf/dl-sysdep.c +++ b/elf/dl-sysdep.c @@ -1,5 +1,5 @@ /* Operating system support for run-time dynamic linker. Generic Unix version. - Copyright (C) 1995-1998, 2000-2005, 2006 Free Software Foundation, Inc. + Copyright (C) 1995-1998, 2000-2006, 2007 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or @@ -460,9 +460,21 @@ _dl_important_hwcaps (const char *platform, size_t platform_len, size_t *sz, total = temp[0].len + 1; else { - total = (1UL << (cnt - 2)) * (temp[0].len + temp[cnt - 1].len + 2); - for (n = 1; n + 1 < cnt; ++n) - total += (1UL << (cnt - 3)) * (temp[n].len + 1); + total = temp[0].len + temp[cnt - 1].len + 2; + if (cnt > 2) + { + total <<= 1; + for (n = 1; n + 1 < cnt; ++n) + total += temp[n].len + 1; + if (cnt > 3 + && (cnt >= sizeof (size_t) * 8 + || total + (sizeof (*result) << 3) + >= (1UL << (sizeof (size_t) * 8 - cnt + 3)))) + _dl_signal_error (ENOMEM, NULL, NULL, + N_("Xcannot create capability list")); + + total <<= cnt - 3; + } } /* The result structure: we use a very compressed way to store the |