53
53
#include " njsIntLob.h"
54
54
#include < stdlib.h>
55
55
#include < iostream>
56
+ #include < limits>
56
57
using namespace std ;
57
58
58
59
// persistent Connection class handle
@@ -70,6 +71,12 @@ Persistent<FunctionTemplate> Connection::connectionTemplate_s;
70
71
// max byte size for a AL32UTF8 char is 4
71
72
#define NJS_CHAR_CONVERSION_RATIO 4
72
73
74
+ #define NJS_SIZE_T_MAX std::numeric_limits<std::size_t >::max()
75
+
76
+ #define NJS_IS_SIZE_T_OVERFLOW (maxSize,maxRows ) \
77
+ ( ( ( maxSize != 0 ) && \
78
+ ( ( ( NJS_SIZE_T_MAX ) / ( (size_t )maxSize ) ) < (maxRows) ) ) ? 1 : 0 ) \
79
+
73
80
/* ****************************************************************************/
74
81
/*
75
82
DESCRIPTION
@@ -725,7 +732,7 @@ void Connection::GetInBindParams (Handle<Value> v8val, Bind* bind,
725
732
bind->maxSize : *(bind->len );
726
733
if (size)
727
734
{
728
- bind->value = (char *)malloc (size);
735
+ bind->value = (char *)malloc (( size_t ) size);
729
736
if (str.length ())
730
737
memcpy (bind->value , *str, str.length ());
731
738
}
@@ -1357,8 +1364,16 @@ void Connection::DoDefines ( eBaton* executeBaton, const dpi::MetaData* meta,
1357
1364
NJS_MAX_FETCH_AS_STRING_SIZE : sizeof (double );
1358
1365
1359
1366
defines[col].maxSize = sizeof (double );
1360
- defines[col].buf = (double *)malloc (defines[col].maxSize *
1361
- executeBaton->maxRows );
1367
+
1368
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( defines[col].maxSize ,
1369
+ executeBaton->maxRows ) )
1370
+ {
1371
+ defines[col].buf = (double *)malloc ( (size_t )defines[col].maxSize *
1372
+ executeBaton->maxRows );
1373
+ }
1374
+ else
1375
+ defines[col].buf = 0 ;
1376
+
1362
1377
if (!defines[col].buf )
1363
1378
{
1364
1379
executeBaton->error = NJSMessages::getErrorMsg (errInsufficientMemory);
@@ -1377,8 +1392,16 @@ void Connection::DoDefines ( eBaton* executeBaton, const dpi::MetaData* meta,
1377
1392
*/
1378
1393
1379
1394
defines[col].maxSize = (meta[col].dbSize ) * NJS_CHAR_CONVERSION_RATIO;
1380
- defines[col].buf = (char *)malloc (defines[col].maxSize *
1381
- executeBaton->maxRows );
1395
+
1396
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( defines[col].maxSize ,
1397
+ executeBaton->maxRows ) )
1398
+ {
1399
+ defines[col].buf = (char *)malloc ( (size_t )defines[col].maxSize *
1400
+ executeBaton->maxRows );
1401
+ }
1402
+ else
1403
+ defines[col].buf = 0 ;
1404
+
1382
1405
if (!defines[col].buf )
1383
1406
{
1384
1407
executeBaton->error = NJSMessages::getErrorMsg (errInsufficientMemory);
@@ -1417,8 +1440,16 @@ void Connection::DoDefines ( eBaton* executeBaton, const dpi::MetaData* meta,
1417
1440
{
1418
1441
/* Fetching DATE/TIMESTAMP values as VARCHAR */
1419
1442
defines[col].maxSize = NJS_MAX_FETCH_AS_STRING_SIZE ;
1420
- defines[col].buf = (char *)malloc ( defines[col].maxSize *
1421
- executeBaton->maxRows );
1443
+
1444
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( defines[col].maxSize ,
1445
+ executeBaton->maxRows ) )
1446
+ {
1447
+ defines[col].buf = (char *)malloc ( (size_t )defines[col].maxSize *
1448
+ executeBaton->maxRows );
1449
+ }
1450
+ else
1451
+ defines[col].buf = 0 ;
1452
+
1422
1453
if (!defines[col].buf )
1423
1454
{
1424
1455
executeBaton->error = NJSMessages::getErrorMsg (
@@ -1433,7 +1464,16 @@ void Connection::DoDefines ( eBaton* executeBaton, const dpi::MetaData* meta,
1433
1464
case dpi::DpiBfile:
1434
1465
defines[col].fetchType = meta[col].dbType ;
1435
1466
defines[col].maxSize = sizeof (Descriptor *);
1436
- defines[col].buf = malloc (defines[col].maxSize * executeBaton->maxRows );
1467
+
1468
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( defines[col].maxSize ,
1469
+ executeBaton->maxRows ) )
1470
+ {
1471
+ defines[col].buf = malloc ( (size_t )defines[col].maxSize *
1472
+ executeBaton->maxRows );
1473
+ }
1474
+ else
1475
+ defines[col].buf = 0 ;
1476
+
1437
1477
if (!defines[col].buf )
1438
1478
{
1439
1479
executeBaton->error = NJSMessages::getErrorMsg (errInsufficientMemory);
@@ -1458,8 +1498,16 @@ void Connection::DoDefines ( eBaton* executeBaton, const dpi::MetaData* meta,
1458
1498
return ;
1459
1499
}
1460
1500
defines[col].maxSize = NJS_MAX_FETCH_AS_STRING_SIZE;
1461
- defines[col].buf = (char *)malloc (defines[col].maxSize *
1462
- executeBaton->maxRows );
1501
+
1502
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( defines[col].maxSize ,
1503
+ executeBaton->maxRows ) )
1504
+ {
1505
+ defines[col].buf = (char *)malloc ( (size_t )defines[col].maxSize *
1506
+ executeBaton->maxRows );
1507
+ }
1508
+ else
1509
+ defines[col].buf = 0 ;
1510
+
1463
1511
if (!defines[col].buf )
1464
1512
{
1465
1513
executeBaton->error = NJSMessages::getErrorMsg (
@@ -2730,7 +2778,21 @@ void Connection::cbDynBufferAllocate ( void *ctx, bool dmlReturning,
2730
2778
{
2731
2779
case dpi::DpiVarChar:
2732
2780
/* one extra char for EOS */
2733
- bind->value = (char *)malloc ( ( bind->maxSize + 1 ) * nRows ) ;
2781
+
2782
+ if ( !NJS_IS_SIZE_T_OVERFLOW ( (bind->maxSize + 1 ), nRows) )
2783
+ {
2784
+ bind->value = (char *)malloc ( (size_t )( bind->maxSize + 1 ) * nRows );
2785
+ }
2786
+ else
2787
+ bind->value = 0 ;
2788
+
2789
+ if ( !bind->value )
2790
+ {
2791
+ executeBaton->error = NJSMessages::getErrorMsg (
2792
+ errInsufficientMemory);
2793
+ return ;
2794
+ }
2795
+
2734
2796
if ( dmlReturning )
2735
2797
{
2736
2798
*(bind->len2 ) = (unsigned int )bind->maxSize ;
0 commit comments