Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1662)

Unified Diff: core/include/fxcrt/fx_basic.h

Issue 334573007: Integer overflow in fx_basic.h and fx_memory.h (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Replace size < 1 with size == 0 Created 6 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | core/include/fxcrt/fx_memory.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: core/include/fxcrt/fx_basic.h
diff --git a/core/include/fxcrt/fx_basic.h b/core/include/fxcrt/fx_basic.h
index 378d6c30a829693001541e72978d4d6a060eb6b3..bdb1599491e7d2cf502f6189bebfafe409ed8ad8 100644
--- a/core/include/fxcrt/fx_basic.h
+++ b/core/include/fxcrt/fx_basic.h
@@ -6,6 +6,10 @@
#ifndef _FX_BASIC_H_
#define _FX_BASIC_H_
+#ifndef _STDINT_H_
+#define _STDINT_H_
+#include <stdint.h>
+#endif
#ifndef _FX_SYSTEM_H_
#include "fx_system.h"
#endif
@@ -18,6 +22,7 @@
#ifndef _FX_STREAM_H_
#include "fx_stream.h"
#endif
+
class CFX_BinaryBuf : public CFX_Object
{
public:
@@ -776,6 +781,9 @@ public:
if (data_size > FixedSize) {
m_pData = FX_Allocator_Alloc(m_pAllocator, DataType, data_size);
} else {
+ if (FixedSize > SIZE_MAX/sizeof(DataType))
+ return;
+
FXSYS_memset32(m_Data, 0, sizeof(DataType)*FixedSize);
}
}
@@ -788,6 +796,10 @@ public:
if (data_size > FixedSize) {
m_pData = FX_Allocator_Alloc(m_pAllocator, DataType, data_size);
} else {
+
+ if (FixedSize > SIZE_MAX/sizeof(DataType))
+ return;
+
FXSYS_memset32(m_Data, 0, sizeof(DataType)*FixedSize);
}
}
« no previous file with comments | « no previous file | core/include/fxcrt/fx_memory.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698