From b058098fdcc5d4ed9b81fdb17f64820c0360ad48 Mon Sep 17 00:00:00 2001 From: Mattias Andrée Date: Mon, 8 Mar 2021 00:21:02 +0100 Subject: m + style fix + check memory allocation overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Mattias Andrée --- libgamma_internal_translated_ramp_get_.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) (limited to 'libgamma_internal_translated_ramp_get_.c') diff --git a/libgamma_internal_translated_ramp_get_.c b/libgamma_internal_translated_ramp_get_.c index 852f6c9..c5f563e 100644 --- a/libgamma_internal_translated_ramp_get_.c +++ b/libgamma_internal_translated_ramp_get_.c @@ -30,7 +30,7 @@ libgamma_internal_translated_ramp_get_(struct libgamma_crtc_state *restrict this size_t n; int r; union gamma_ramps_any ramps_sys; - uint64_t *restrict ramps_full; + uint64_t *restrict ramps_full = NULL; /* Allocate ramps with proper data type */ if ((r = libgamma_internal_allocated_any_ramp(&ramps_sys, ramps, depth_system, &n))) @@ -43,10 +43,17 @@ libgamma_internal_translated_ramp_get_(struct libgamma_crtc_state *restrict this } /* Allocate intermediary ramps */ - ramps_full = malloc(n * sizeof(*ramps_full)); - if (!ramps_full) { - free(ramps_sys.ANY.red); - return LIBGAMMA_ERRNO_SET; + if (n) { + if (n > SIZE_MAX / sizeof(*ramps_full)) { + errno = ENOMEM; + free(ramps_sys.ANY.red); + return LIBGAMMA_ERRNO_SET; + } + ramps_full = malloc(n * sizeof(*ramps_full)); + if (!ramps_full) { + free(ramps_sys.ANY.red); + return LIBGAMMA_ERRNO_SET; + } } /* Translate ramps to 64-bit integers */ -- cgit v1.2.3-70-g09d2