Roll libxml to bdec2183f34b37ee89ae1d330c6ad2bb4d76605f

third_party/libxml/src/xmlmemory.c

 /*
  * xmlmemory.c:  libxml memory allocator wrapper.
  *
  * daniel@veillard.com
  */
 
 #define IN_LIBXML
 #include "libxml.h"
 
 #include <string.h>
@@ skipping 91 matching lines @@
 
 #ifdef SUN4
 #define ALIGN_SIZE  16
 #else
 #define ALIGN_SIZE  sizeof(double)
 #endif
 #define HDR_SIZE    sizeof(MEMHDR)
 #define RESERVE_SIZE (((HDR_SIZE + (ALIGN_SIZE-1)) \
                       / ALIGN_SIZE ) * ALIGN_SIZE)
 
+#define MAX_SIZE_T ((size_t)-1)
 
 #define CLIENT_2_HDR(a) ((MEMHDR *) (((char *) (a)) - RESERVE_SIZE))
 #define HDR_2_CLIENT(a)    ((void *) (((char *) (a)) + RESERVE_SIZE))
 
 
 static unsigned int block=0;
 static unsigned int xmlMemStopAtBlock = 0;
 static void *xmlMemTraceBlockAt = NULL;
 #ifdef MEM_LIST
 static MEMHDR *memlist = NULL;
@@ skipping 88 matching lines @@
         xmlMallocBreakpoint();
     }
 
     TEST_POINT
 
     return(ret);
 }
 
 /**
  * xmlMallocAtomicLoc:
- * @size:  an int specifying the size in byte to allocate.
+ * @size:  an unsigned int specifying the size in byte to allocate.
  * @file:  the file name or NULL
  * @line:  the line number
  *
  * a malloc() equivalent, with logging of the allocation info.
  *
  * Returns a pointer to the allocated area or NULL in case of lack of memory.
  */
 
 void *
 xmlMallocAtomicLoc(size_t size, const char * file, int line)
 {
     MEMHDR *p;
     void *ret;
 
     if (!xmlMemInitialized) xmlInitMemory();
 #ifdef DEBUG_MEMORY
     xmlGenericError(xmlGenericErrorContext,
             "Malloc(%d)\n",size);
 #endif
 
     TEST_POINT
 
+    if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
+        xmlGenericError(xmlGenericErrorContext,
+                "xmlMallocAtomicLoc : Unsigned overflow prevented\n");
+        xmlMemoryDump();
+        return(NULL);
+    }
+
     p = (MEMHDR *) malloc(RESERVE_SIZE+size);
 
     if (!p) {
         xmlGenericError(xmlGenericErrorContext,
-                "xmlMallocLoc : Out of free space\n");
+                "xmlMallocAtomicLoc : Out of free space\n");
         xmlMemoryDump();
         return(NULL);
     }
     p->mh_tag = MEMTAG;
     p->mh_size = size;
     p->mh_type = MALLOC_ATOMIC_TYPE;
     p->mh_file = file;
     p->mh_line = line;
     xmlMutexLock(xmlMemMutex);
     p->mh_number = ++block;
@@ skipping 867 matching lines @@
     if (freeFunc != NULL) *freeFunc = xmlFree;
     if (mallocFunc != NULL) *mallocFunc = xmlMalloc;
     if (mallocAtomicFunc != NULL) *mallocAtomicFunc = xmlMallocAtomic;
     if (reallocFunc != NULL) *reallocFunc = xmlRealloc;
     if (strdupFunc != NULL) *strdupFunc = xmlMemStrdup;
     return(0);
 }
 
 #define bottom_xmlmemory
 #include "elfgcchack.h"