@@ -148,6 +148,14 @@ mbfl_memory_device_output(int c, void *data)
148148 /* overflow */
149149 return -1 ;
150150 }
151+
152+ newlen = device -> length + device -> allocsz ;
153+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
154+ if (tmp == NULL ) {
155+ return -1 ;
156+ }
157+ device -> length = newlen ;
158+ device -> buffer = tmp ;
151159 }
152160
153161 device -> buffer [device -> pos ++ ] = (unsigned char )c ;
@@ -168,6 +176,14 @@ mbfl_memory_device_output2(int c, void *data)
168176 /* overflow */
169177 return -1 ;
170178 }
179+
180+ newlen = device -> length + device -> allocsz ;
181+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
182+ if (tmp == NULL ) {
183+ return -1 ;
184+ }
185+ device -> length = newlen ;
186+ device -> buffer = tmp ;
171187 }
172188
173189 device -> buffer [device -> pos ++ ] = (unsigned char )((c >> 8 ) & 0xff );
@@ -190,6 +206,14 @@ mbfl_memory_device_output4(int c, void* data)
190206 /* overflow */
191207 return -1 ;
192208 }
209+
210+ newlen = device -> length + device -> allocsz ;
211+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
212+ if (tmp == NULL ) {
213+ return -1 ;
214+ }
215+ device -> length = newlen ;
216+ device -> buffer = tmp ;
193217 }
194218
195219 device -> buffer [device -> pos ++ ] = (unsigned char )((c >> 24 ) & 0xff );
@@ -221,6 +245,15 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, size_t
221245 /* overflow */
222246 return -1 ;
223247 }
248+
249+ newlen = device -> length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE ;
250+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
251+ if (tmp == NULL ) {
252+ return -1 ;
253+ }
254+
255+ device -> length = newlen ;
256+ device -> buffer = tmp ;
224257 }
225258
226259 w = & device -> buffer [device -> pos ];
@@ -274,6 +307,19 @@ mbfl_wchar_device_output(int c, void *data)
274307 /* overflow */
275308 return -1 ;
276309 }
310+
311+ newlen = device -> length + device -> allocsz ;
312+ if (newlen > SIZE_MAX / sizeof (int )) {
313+ /* overflow */
314+ return -1 ;
315+ }
316+
317+ tmp = (unsigned int * )mbfl_realloc ((void * )device -> buffer , newlen * sizeof (int ));
318+ if (tmp == NULL ) {
319+ return -1 ;
320+ }
321+ device -> length = newlen ;
322+ device -> buffer = tmp ;
277323 }
278324
279325 device -> buffer [device -> pos ++ ] = c ;
0 commit comments