# HG changeset patch # User Florian Weimer <fweimer@redhat.com> # Date 1391474881 28800 # Mon Feb 03 16:48:01 2014 -0800 # Node ID 8a3b91a7e20462303960e749d771ca1a7cade7ad # Parent 6b808cf7df17cbe19d87767a7ec6ba53a4c4a30e yaml_stack_extend: guard against integer overflow diff --git a/src/api.c b/src/api.c --- a/src/api.c +++ b/src/api.c @@ -117,7 +117,12 @@ YAML_DECLARE(int) yaml_stack_extend(void **start, void **top, void **end) { - void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); + void *new_start; + + if ((char *)*end - (char *)*start >= INT_MAX / 2) + return 0; + + new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); if (!new_start) return 0;