Integer overflow in fx_basic.h and fx_memory.h

core/src/fxcrt/fx_basic_memmgr.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/fxcrt/fx_basic.h"
 #include "mem_int.h"
+
 void FXMEM_DestroyFoxitMgr(FXMEM_FoxitMgr* pFoxitMgr)
 {
     if (pFoxitMgr == NULL) {
         return;
     }
     CFX_MemoryMgr* p = (CFX_MemoryMgr*)pFoxitMgr;
     if (p->m_pSystemMgr->CollectAll) {
         p->m_pSystemMgr->CollectAll(p->m_pSystemMgr);
     }
     if (p->m_bReleaseMgr) {
         p->m_pSystemMgr->Free(p->m_pSystemMgr, p, 0);
     }
     if (p->m_pExternalMemory) {
         free(p->m_pExternalMemory);
     }
 }
 #ifdef __cplusplus
 extern "C" {
 #endif
-static void* _DefAllocDebug(IFX_Allocator* pAllocator, size_t size, FX_LPCSTR filename, int line)
+static void* _DefAllocDebug(IFX_Allocator* pAllocator, size_t num, size_t size, FX_LPCSTR filename, int line)
 {
+    if (size == 0 || num > SIZE_MAX/size)
+        return NULL;
+
+    size = size * num; 
     return ((FX_DefAllocator*)pAllocator)->m_pFoxitMgr->AllocDebug(size, 0, filename, line);
 }
-static void* _DefAlloc(IFX_Allocator* pAllocator, size_t size)
+static void* _DefAlloc(IFX_Allocator* pAllocator, size_t num, size_t size)
 {
+    if (size == 0 || num > SIZE_MAX/size)
+        return NULL;
+
+    size = size * num;
     return ((FX_DefAllocator*)pAllocator)->m_pFoxitMgr->Alloc(size, 0);
 }
-static void* _DefReallocDebug(IFX_Allocator* pAllocator, void* p, size_t size, FX_LPCSTR filename, int line)
+static void* _DefReallocDebug(IFX_Allocator* pAllocator, void* p, size_t new_num, size_t size, FX_LPCSTR filename, int line)
 {
+    if (size == 0 || new_num > SIZE_MAX/size)
+        return NULL;
+
+    size = size * new_num;
     return ((FX_DefAllocator*)pAllocator)->m_pFoxitMgr->ReallocDebug(p, size, 0, filename, line);
 }
-static void* _DefRealloc(IFX_Allocator* pAllocator, void* p, size_t size)
+static void* _DefRealloc(IFX_Allocator* pAllocator, void* p, size_t new_num, size_t size)
 {
+    if (size == 0 || new_num > SIZE_MAX/size)
+        return NULL;
+
+    size = size * new_num;
     return ((FX_DefAllocator*)pAllocator)->m_pFoxitMgr->Realloc(p, size, 0);
 }
 static void _DefFree(IFX_Allocator* pAllocator, void* p)
 {
     ((FX_DefAllocator*)pAllocator)->m_pFoxitMgr->Free(p, 0);
 }
 #ifdef __cplusplus
 }
 #endif
 void CFX_MemoryMgr::Init(FXMEM_SystemMgr* pSystemMgr)
@@ skipping 134 matching lines @@
 void CFX_Object::operator delete(void* p, FX_LPCSTR file, int line)
 {
     g_pDefFoxitMgr->Free(p, 0);
 }
 void CFX_Object::operator delete[](void* p, FX_LPCSTR file, int line)
 {
     g_pDefFoxitMgr->Free(p, 0);
 }
 void* CFX_AllocObject::operator new(size_t size, IFX_Allocator* pAllocator, FX_LPCSTR filename, int line)
 {
-    void* p = pAllocator ? pAllocator->m_AllocDebug(pAllocator, size, filename, line) :
+    void* p = pAllocator ? pAllocator->m_AllocDebug(pAllocator, size, 1, filename, line) :
               g_pDefFoxitMgr->AllocDebug(size, 0, filename, line);
     ((CFX_AllocObject*)p)->m_pAllocator = pAllocator;
     return p;
 }
 void CFX_AllocObject::operator delete (void* p, IFX_Allocator* pAllocator, FX_LPCSTR filename, int line)
 {
     if (pAllocator) {
         pAllocator->m_Free(pAllocator, p);
     } else {
         g_pDefFoxitMgr->Free(p, 0);
     }
 }
 void* CFX_AllocObject::operator new(size_t size, IFX_Allocator* pAllocator)
 {
-    void* p = pAllocator ? pAllocator->m_Alloc(pAllocator, size) : g_pDefFoxitMgr->Alloc(size, 0);
+    void* p = pAllocator ? pAllocator->m_Alloc(pAllocator, size, 1) : g_pDefFoxitMgr->Alloc(size, 0);
     ((CFX_AllocObject*)p)->m_pAllocator = pAllocator;
     return p;
 }
 void CFX_AllocObject::operator delete(void* p)
 {
     if (((CFX_AllocObject*)p)->m_pAllocator) {
         (((CFX_AllocObject*)p)->m_pAllocator)->m_Free(((CFX_AllocObject*)p)->m_pAllocator, p);
     } else {
         g_pDefFoxitMgr->Free(p, 0);
     }
 }
 void CFX_AllocObject::operator delete(void* p, IFX_Allocator* pAllocator)
 {
     if (pAllocator) {
         pAllocator->m_Free(pAllocator, p);
     } else {
         g_pDefFoxitMgr->Free(p, 0);
     }
 }
 extern "C" {
-    static void* _GOPAllocDebug(IFX_Allocator* pAllocator, size_t size, FX_LPCSTR file, int line)
+    static void* _GOPAllocDebug(IFX_Allocator* pAllocator, size_t num, size_t size, FX_LPCSTR file, int line)
     {
+        if (size == 0 || num > SIZE_MAX/size)
+            return NULL;
+
+        size = size * num;
         return ((CFX_GrowOnlyPool*)pAllocator)->Alloc(size);
     }
-    static void* _GOPAlloc(IFX_Allocator* pAllocator, size_t size)
+    static void* _GOPAlloc(IFX_Allocator* pAllocator, size_t num, size_t size)
     {
+        if (size == 0 || num > SIZE_MAX/size)
+            return NULL;
+
+        size = size * num;
         return ((CFX_GrowOnlyPool*)pAllocator)->Alloc(size);
     }
-    static void* _GOPReallocDebug(IFX_Allocator* pAllocator, void* p, size_t new_size, FX_LPCSTR file, int line)
+    static void* _GOPReallocDebug(IFX_Allocator* pAllocator, void* p, size_t new_num, size_t size, FX_LPCSTR file, int line)
     {
-        return ((CFX_GrowOnlyPool*)pAllocator)->Realloc(p, new_size);
+        if (size == 0 || new_num > SIZE_MAX/size)
+            return NULL;
+
+        size = size * new_num;
+        return ((CFX_GrowOnlyPool*)pAllocator)->Realloc(p, size);
     }
-    static void* _GOPRealloc(IFX_Allocator* pAllocator, void* p, size_t new_size)
+    static void* _GOPRealloc(IFX_Allocator* pAllocator, void* p, size_t new_num, size_t size)
     {
-        return ((CFX_GrowOnlyPool*)pAllocator)->Realloc(p, new_size);
+        if (size == 0 || new_num > SIZE_MAX/size)
+            return NULL;
+
+        size = size * new_num;
+        return ((CFX_GrowOnlyPool*)pAllocator)->Realloc(p, size);
     }
     static void _GOPFree(IFX_Allocator* pAllocator, void* p)
     {
     }
 };
 CFX_GrowOnlyPool::CFX_GrowOnlyPool(IFX_Allocator* pAllocator, size_t trunk_size)
 {
     m_TrunkSize = trunk_size;
     m_pFirstTrunk = NULL;
     m_pAllocator = pAllocator ? pAllocator : &g_pDefFoxitMgr->m_DefAllocator.m_Allocator;
@@ skipping 33 matching lines @@
     _FX_GrowOnlyTrunk* pTrunk = (_FX_GrowOnlyTrunk*)m_pFirstTrunk;
     while (pTrunk) {
         if (pTrunk->m_Size - pTrunk->m_Allocated >= size) {
             void* p = (FX_LPBYTE)(pTrunk + 1) + pTrunk->m_Allocated;
             pTrunk->m_Allocated += size;
             return p;
         }
         pTrunk = pTrunk->m_pNext;
     }
     size_t alloc_size = size > m_TrunkSize ? size : m_TrunkSize;
-    pTrunk = (_FX_GrowOnlyTrunk*)m_pAllocator->m_Alloc(m_pAllocator, sizeof(_FX_GrowOnlyTrunk) + alloc_size);
+    
+    if (alloc_size > SIZE_MAX - sizeof(_FX_GrowOnlyTrunk) )
+        return NULL;
+
+    pTrunk = (_FX_GrowOnlyTrunk*)m_pAllocator->m_Alloc(m_pAllocator, sizeof(_FX_GrowOnlyTrunk) + alloc_size, 1);
     pTrunk->m_Size = alloc_size;
     pTrunk->m_Allocated = size;
     pTrunk->m_pNext = (_FX_GrowOnlyTrunk*)m_pFirstTrunk;
     m_pFirstTrunk = pTrunk;
     return pTrunk + 1;
 }