Sisyphus repository
Last update: 1 october 2023 | SRPMs: 18631 | Visits: 37713101
en ru br
ALT Linux repos
S:2.3.3-alt1
5.0: 2.1.3-alt2
4.1: 2.1.3-alt2
4.0: 2.1.3-alt0.M40.2

Group :: System/Libraries
RPM: slang2

 Main   Changelog   Spec   Patches   Sources   Download   Gear   Bugs and FR  Repocop 

Patch: slang-2.3.2-slarray-ub.patch
Download


diff --git a/src/slarray.c b/src/slarray.c
index d26aaec..6c338b5 100644
--- a/src/slarray.c
+++ b/src/slarray.c
@@ -22,6 +22,7 @@ USA.
 
 #include "slinclud.h"
 #include <math.h>
+#include <limits.h>
 
 /* #define SL_APP_WANTS_FOREACH */
 #include "slang.h"
@@ -312,6 +313,26 @@ void SLang_free_array (SLang_Array_Type *at)
    free_array (at);
 }
 
+/* Here, a and b are assumed to be non-negative */
+static int check_overflow_mult_i (SLindex_Type a, SLindex_Type b, SLindex_Type *cp)
+{
+   if ((a < 0) || (b < 0) || ((b > 0) && (a > INT_MAX/b)))
+     return -1;
+
+   *cp = a*b;
+
+   return 0;
+}
+
+static int check_overflow_mult_ui (SLuindex_Type a, SLindex_Type b, SLuindex_Type *cp)
+{
+   if ((b < 0) || ((b > 0) && (a > UINT_MAX/(SLuindex_Type)b)))
+     return -1;
+
+   *cp = a*(SLuindex_Type)b;
+   return 0;
+}
+
 SLang_Array_Type *
 SLang_create_array1 (SLtype type, int read_only, VOID_STAR data,
 		     SLindex_Type *dims, unsigned int num_dims, int no_init)
@@ -366,16 +387,14 @@ SLang_create_array1 (SLtype type, int read_only, VOID_STAR data,
    num_elements = 1;
    for (i = 0; i < num_dims; i++)
      {
-	SLindex_Type new_num_elements;
 	at->dims[i] = dims[i];
-	new_num_elements = dims[i] * num_elements;
-	if (dims[i] && (new_num_elements/dims[i] != num_elements))
+
+	if (-1 == check_overflow_mult_i (num_elements, dims[i], &num_elements))
 	  {
 	     throw_size_error (SL_Index_Error);
 	     free_array (at);
 	     return NULL;
 	  }
-	num_elements = new_num_elements;
      }
 
    /* Now set the rest of the unused dimensions to 1.  This makes it easier
@@ -395,8 +414,10 @@ SLang_create_array1 (SLtype type, int read_only, VOID_STAR data,
 	return at;
      }
 
-   size = (num_elements * sizeof_type);
-   if ((size/sizeof_type != num_elements) || (size < 0))
+   /* SLmalloc is currently limited to the use of unsigned integers.
+    * So include the size of the type as well.
+    */
+   if (-1 == check_overflow_mult_i (num_elements, sizeof_type, &size))
      {
 	throw_size_error (SL_INVALID_PARM);
 	free_array (at);
@@ -1103,7 +1124,6 @@ convert_nasty_index_objs (SLang_Array_Type *at,
    total_num_elements = 1;
    for (i = 0; i < num_indices; i++)
      {
-	SLuindex_Type new_total_num_elements;
 	SLang_Object_Type *obj = index_objs + i;
 	range_delta_buf [i] = 0;
 
@@ -1145,13 +1165,11 @@ convert_nasty_index_objs (SLang_Array_Type *at,
 	       }
 	  }
 
-	new_total_num_elements = total_num_elements * max_dims[i];
-	if (max_dims[i] && (new_total_num_elements/max_dims[i] != total_num_elements))
+	if (-1 == check_overflow_mult_ui (total_num_elements, max_dims[i], &total_num_elements))
 	  {
 	     throw_size_error (SL_INVALID_PARM);
 	     return -1;
 	  }
-       total_num_elements = new_total_num_elements;
      }
 
    *num_elements = total_num_elements;
 
design & coding: Vladimir Lettiev aka crux © 2004-2005, Andrew Avramenko aka liks © 2007-2008
current maintainer: Michael Shigorin