Check for value overlow in buffer.cc

core/cross/buffer.cc

 /*
  * Copyright 2009, Google Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 141 matching lines @@
   }
 
   if (num_elements > MAX_LARGE_INDEX) {
     O3D_ERROR(service_locator())
         << "The maximum number of elements in a buffer is " << MAX_LARGE_INDEX
         << ".";
     return false;
   }
 
   size_t size_in_bytes = num_elements * stride_;
+  // Check for size_t overflow.
+  if (size_in_bytes / stride_ != num_elements) {
+    O3D_ERROR(service_locator())
+        << "Attempt to allocate too many elements for the current set of "
+        << "fields on buffer.";
+    return false;
+  }
 
   if (size_in_bytes == 0) {
     O3D_ERROR(service_locator())
         << "Attempt to allocate zero bytes for Buffer '" << name() << "'";
     return false;
   }
 
   bool success = true;
   if (!ConcreteAllocate(size_in_bytes)) {
     num_elements = 0;
@@ skipping 425 matching lines @@
     locked_ = buffer_->Lock(access_mode, &data_);
     if (!locked_) {
       O3D_ERROR(buffer_->service_locator())
           << "Unable to lock buffer '" << buffer_->name() << "'";
     }
   }
   return data_;
 }
 
 }  // namespace o3d