Skip to content

Commit 4f167a0

Browse files
author
Release Manager
committed
gh-40338: Fix 32-bit segfault in m4ri Adding upstream patch from malb/m4ri#28 URL: #40338 Reported by: Volker Braun Reviewer(s):
2 parents be9fc2c + 3a8ce34 commit 4f167a0

File tree

1 file changed

+45
-0
lines changed

1 file changed

+45
-0
lines changed
Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From b178ed36bdd841a76b6595edb77631886e099406 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Gonzalo=20Tornar=C3=ADa?= <[email protected]>
3+
Date: Mon, 3 Feb 2025 17:19:37 -0300
4+
Subject: [PATCH] Fix overflows in `mzd_init()`
5+
6+
---
7+
m4ri/mmc.h | 4 ++++
8+
m4ri/mzd.c | 5 ++---
9+
2 files changed, 6 insertions(+), 3 deletions(-)
10+
11+
diff --git a/m4ri/mmc.h b/m4ri/mmc.h
12+
index e6db4ca..3e97391 100644
13+
--- a/m4ri/mmc.h
14+
+++ b/m4ri/mmc.h
15+
@@ -72,6 +72,10 @@ typedef struct _mm_block {
16+
* \return Pointer to allocated memory block.
17+
*/
18+
static inline void *m4ri_mmc_calloc(size_t count, size_t size) {
19+
+ if (size && count > SIZE_MAX/size) {
20+
+ m4ri_die("m4ri_mmc_calloc: overflow in multiplication\n");
21+
+ return NULL; /* unreachable */
22+
+ }
23+
size_t total_size = count * size;
24+
void *ret = m4ri_mmc_malloc(total_size);
25+
memset((char *)ret, 0, total_size);
26+
diff --git a/m4ri/mzd.c b/m4ri/mzd.c
27+
index ba04b7c..ac62c5c 100644
28+
--- a/m4ri/mzd.c
29+
+++ b/m4ri/mzd.c
30+
@@ -144,13 +144,12 @@ mzd_t *mzd_init(rci_t r, rci_t c) {
31+
mzd_t *A = mzd_t_malloc();
32+
A->nrows = r;
33+
A->ncols = c;
34+
- A->width = (c + m4ri_radix - 1) / m4ri_radix;
35+
+ A->width = c > 0 ? (c - 1) / m4ri_radix + 1 : 0;
36+
A->rowstride = ((A->width & 1) == 0) ? A->width : A->width + 1;
37+
A->high_bitmask = __M4RI_LEFT_BITMASK(c % m4ri_radix);
38+
A->flags = (A->high_bitmask != m4ri_ffff) ? mzd_flag_nonzero_excess : 0;
39+
if (r && c) {
40+
- size_t block_words = r * A->rowstride;
41+
- A->data = m4ri_mmc_calloc(block_words, sizeof(word));
42+
+ A->data = m4ri_mmc_calloc(r, sizeof(word) * A->rowstride);
43+
} else {
44+
A->data = NULL;
45+
}

0 commit comments

Comments
 (0)