Skip to content

Commit 9449e3a

Browse files
committed
CDRIVER-3592 check new buffer allocated size just before reallocating
1 parent 1b9ce0d commit 9449e3a

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/libmongoc/src/mongoc/mongoc-buffer.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,14 +134,14 @@ _mongoc_buffer_append (mongoc_buffer_t *buffer,
134134
BSON_ASSERT (data_size);
135135

136136
BSON_ASSERT (buffer->datalen);
137-
BSON_ASSERT ((buffer->datalen + data_size) < INT_MAX);
138137

139138
if (!SPACE_FOR (buffer, data_size)) {
140139
if (buffer->len) {
141140
memmove (&buffer->data[0], buffer->data, buffer->len);
142141
}
143142

144143
if (!SPACE_FOR (buffer, data_size)) {
144+
BSON_ASSERT ((buffer->datalen + data_size) < INT_MAX);
145145
buffer->datalen = bson_next_power_of_two (data_size + buffer->len);
146146
buffer->data = (uint8_t *) buffer->realloc_func (
147147
buffer->data, buffer->datalen, NULL);
@@ -191,14 +191,14 @@ _mongoc_buffer_append_from_stream (mongoc_buffer_t *buffer,
191191
BSON_ASSERT (size);
192192

193193
BSON_ASSERT (buffer->datalen);
194-
BSON_ASSERT ((buffer->datalen + size) < INT_MAX);
195194

196195
if (!SPACE_FOR (buffer, size)) {
197196
if (buffer->len) {
198197
memmove (&buffer->data[0], buffer->data, buffer->len);
199198
}
200199

201200
if (!SPACE_FOR (buffer, size)) {
201+
BSON_ASSERT ((buffer->datalen + size) < INT_MAX);
202202
buffer->datalen = bson_next_power_of_two (size + buffer->len);
203203
buffer->data = (uint8_t *) buffer->realloc_func (
204204
buffer->data, buffer->datalen, NULL);
@@ -330,9 +330,9 @@ _mongoc_buffer_try_append_from_stream (mongoc_buffer_t *buffer,
330330
BSON_ASSERT (size);
331331

332332
BSON_ASSERT (buffer->datalen);
333-
BSON_ASSERT ((buffer->datalen + size) < INT_MAX);
334333

335334
if (!SPACE_FOR (buffer, size)) {
335+
BSON_ASSERT ((buffer->datalen + size) < INT_MAX);
336336
buffer->datalen = bson_next_power_of_two (size + buffer->len);
337337
buffer->data =
338338
(uint8_t *) buffer->realloc_func (buffer->data, buffer->datalen, NULL);

0 commit comments

Comments
 (0)