ce426f
commit 27572ef96a66b61f5a6d81196c05983ab3dc9994
ce426f
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
ce426f
Date:   Sun Jun 30 20:45:19 2013 +0530
ce426f
ce426f
    Check for integer overflow
ce426f
ce426f
diff --git glibc-2.17-c758a686/string/strcoll_l.c glibc-2.17-c758a686/string/strcoll_l.c
ce426f
index 1be6874..cbe5962 100644
ce426f
--- glibc-2.17-c758a686/string/strcoll_l.c
ce426f
+++ glibc-2.17-c758a686/string/strcoll_l.c
ce426f
@@ -524,6 +524,14 @@ STRCOLL (const STRING_TYPE *s1, const STRING_TYPE *s2, __locale_t l)
ce426f
   memset (&seq1, 0, sizeof (seq1));
ce426f
   seq2 = seq1;
ce426f
 
ce426f
+  size_t size_max = SIZE_MAX / (sizeof (int32_t) + 1);
ce426f
+
ce426f
+  /* If the strings are long enough to cause overflow in the size request, then
ce426f
+     skip the allocation and proceed with the non-cached routines.  */
ce426f
+  if (MIN (s1len, s2len) > size_max
ce426f
+      || MAX (s1len, s2len) > size_max - MIN (s1len, s2len))
ce426f
+    goto begin_collate;
ce426f
+
ce426f
   if (! __libc_use_alloca ((s1len + s2len) * (sizeof (int32_t) + 1)))
ce426f
     {
ce426f
       seq1.idxarr = (int32_t *) malloc ((s1len + s2len) * (sizeof (int32_t) + 1));
ce426f
@@ -546,8 +554,10 @@ STRCOLL (const STRING_TYPE *s1, const STRING_TYPE *s2, __locale_t l)
ce426f
       seq2.rulearr = (unsigned char *) alloca (s2len);
ce426f
     }
ce426f
 
ce426f
-  int rule = 0;
ce426f
+  int rule;
ce426f
 
ce426f
+ begin_collate:
ce426f
+  rule = 0;
ce426f
   /* Cache values in the first pass and if needed, use them in subsequent
ce426f
      passes.  */
ce426f
   for (int pass = 0; pass < nrules; ++pass)