Skip to content

Commit e4bcc78

Browse files
committed
fix potential MEM_SIZE overflow in expected_size()
Coverity says: CID 584099: Integer handling issues (INTEGER_OVERFLOW) Expression "newlen + 8UL", where "newlen" is known to be equal to 18446744073709551615, overflows the type of "newlen + 8UL", which is type "unsigned long". (Referring to (n) + PTRSIZE - 1 where n = newlen and PTRSIZE = 8UL.) Crudely avoid the issue by checking n for overflow beforehand and dying with a "panic: memory wrap" error if so.
1 parent 67972cb commit e4bcc78

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

perl.h

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1700,8 +1700,15 @@ Use L</UV> to declare variables of the maximum usable size on this platform.
17001700
* multiple of PTRSIZE, for a minimum of PERL_STRLEN_NEW_MIN. This is
17011701
* not entirely useless, just not terribly accurate.
17021702
*/
1703-
#define expected_size(n) ( ((n) > PERL_STRLEN_NEW_MIN) \
1704-
? (((n) + PTRSIZE - 1) & ~(PTRSIZE - 1)) \
1703+
#define expected_size(n) ( ((n) > PERL_STRLEN_NEW_MIN) \
1704+
? ( \
1705+
(void)( \
1706+
(MEM_SIZE)(n) > MEM_SIZE_MAX - (PTRSIZE - 1) \
1707+
? (croak_memory_wrap(), 0) \
1708+
: 0 \
1709+
), \
1710+
((MEM_SIZE)(n) + (PTRSIZE - 1)) & ~(MEM_SIZE)(PTRSIZE - 1) \
1711+
) \
17051712
: PERL_STRLEN_NEW_MIN )
17061713

17071714
/* This use of offsetof() requires /Zc:offsetof- for VS2017 (and presumably

0 commit comments

Comments
 (0)