mirror/json-c
1
0
Fork 0
mirror of https://github.com/json-c/json-c.git synced 2026-03-23 06:59:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #745 from c3h2-ctf/vasprintf

Browse Source 
vasprintf(): avoid out of memory accesses
This commit is contained in:
Eric Hawicz
2022-02-27 08:34:21 -05:00
committed by GitHub
parent 723ac8cbb5 5c72257220
commit bd56cc8bf7
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
vasprintf_compat.h
View File

@@ -8,6 +8,10 @@
#include "snprintf_compat.h"
#ifndef WIN32
#include <stdarg.h>
#endif /* !defined(WIN32) */
#include <stdint.h>
#include <stdlib.h>
#if !defined(HAVE_VASPRINTF)
@@ -16,6 +20,7 @@ static int vasprintf(char **buf, const char *fmt, va_list ap)
{
#ifndef WIN32
static char _T_emptybuffer = '\0';
va_list ap2;
#endif /* !defined(WIN32) */
int chars;
char *b;
@@ -26,19 +31,21 @@ static int vasprintf(char **buf, const char *fmt, va_list ap)
}
#ifdef WIN32
chars = _vscprintf(fmt, ap) + 1;
chars = _vscprintf(fmt, ap);
#else /* !defined(WIN32) */
/* CAW: RAWR! We have to hope to god here that vsnprintf doesn't overwrite
* our buffer like on some 64bit sun systems.... but hey, its time to move on
* our buffer like on some 64bit sun systems... but hey, it's time to move on
*/
chars = vsnprintf(&_T_emptybuffer, 0, fmt, ap) + 1;
if (chars < 0)
{
chars *= -1;
} /* CAW: old glibc versions have this problem */
va_copy(ap2, ap);
chars = vsnprintf(&_T_emptybuffer, 0, fmt, ap2);
va_end(ap2);
#endif /* defined(WIN32) */
if (chars < 0 || (size_t)chars + 1 > SIZE_MAX / sizeof(char))
{
return -1;
}
b = (char *)malloc(sizeof(char) * chars);
b = (char *)malloc(sizeof(char) * ((size_t)chars + 1));
if (!b)
{
return -1;