Commit Graph
3 Commits
Author SHA1 Message Date
Tobias Stoeckmann d07b910149 Fix integer overflows.
The data structures linkhash and printbuf are limited to 2 GB in size
due to a signed integer being used to track their current size.

If too much data is added, then size variable can overflow, which is
an undefined behaviour in C programming language.

Assuming that a signed int overflow just leads to a negative value,
like it happens on many sytems (Linux i686/amd64 with gcc), then
printbuf is vulnerable to an out of boundary write on 64 bit systems.
2020-05-06 20:46:12 +02:00
Tobias Stoeckmann 77d935b7ae Prevent division by zero in linkhash.
If a linkhash with a size of zero is created, then modulo operations
are prone to division by zero operations.

Purely protective measure against bad usage.
2020-05-04 19:46:45 +02:00
Tobias Stoeckmann 099016b7e8 Protect array_list_del_idx against size_t overflow.
If the assignment of stop overflows due to idx and count being
larger than SIZE_T_MAX in sum, out of boundary access could happen.

It takes invalid usage of this function for this to happen, but
I decided to add this check so array_list_del_idx is as safe against
bad usage as the other arraylist functions.
2020-05-04 19:41:16 +02:00