Commit | Line | Data |
---|---|---|
35a12b47 MW |
1 | The file names in the upstream patch below were modified to apply to GNU |
2 | ghostscript. | |
3 | ||
4 | From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001 | |
5 | From: Chris Liddell <chris.liddell@artifex.com> | |
6 | Date: Tue, 7 Jul 2015 16:57:41 +0100 | |
7 | Subject: [PATCH] Bug 696041: sanity check for memory allocation. | |
8 | ||
9 | In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the | |
10 | variable holding the actual number of bytes we allocate. | |
11 | ||
12 | No cluster differences | |
13 | --- | |
14 | gs/base/gsmalloc.c | 2 +- | |
15 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
16 | ||
17 | diff --git a/base/gsmalloc.c b/base/gsmalloc.c | |
18 | index 624552d..cad79c2 100644 | |
19 | --- a/base/gsmalloc.c | |
20 | +++ b/base/gsmalloc.c | |
21 | @@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size, client_name_t cname) | |
22 | } else { | |
23 | uint added = size + sizeof(gs_malloc_block_t); | |
24 | ||
25 | - if (mmem->limit - added < mmem->used) | |
26 | + if (added <= size || mmem->limit - added < mmem->used) | |
27 | set_msg("exceeded limit"); | |
28 | else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0) | |
29 | set_msg("failed"); | |
30 | -- | |
31 | 2.4.6 | |
32 |