diff options
| author | Nick Mathewson <nickm@torproject.org> | 2010-12-15 22:47:28 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2010-12-15 22:48:23 -0500 |
| commit | b5e293afe6b3c98b50c23cc443969b5f840dca32 (patch) | |
| tree | 803a93a09d717782452108ab21ab2cac6a732f26 /src/common/memarea.c | |
| parent | ddfb398494ddf9d514a3ff16ade69c619c659ce7 (diff) | |
| parent | b0def605a52b3acce1cb212f270b184d72f237f5 (diff) | |
| download | tor-b5e293afe6b3c98b50c23cc443969b5f840dca32.tar.gz tor-b5e293afe6b3c98b50c23cc443969b5f840dca32.zip | |
Merge remote branch fix_security_bug_021 into fix_security_bug_022
Conflicts:
src/common/memarea.c
src/or/or.h
src/or/rendclient.c
Diffstat (limited to 'src/common/memarea.c')
| -rw-r--r-- | src/common/memarea.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/common/memarea.c b/src/common/memarea.c index 77579e63be..dac15434c0 100644 --- a/src/common/memarea.c +++ b/src/common/memarea.c @@ -95,6 +95,7 @@ static memarea_chunk_t *freelist = NULL; static memarea_chunk_t * alloc_chunk(size_t sz, int freelist_ok) { + tor_assert(sz < SIZE_T_CEILING); if (freelist && freelist_ok) { memarea_chunk_t *res = freelist; freelist = res->next_chunk; @@ -211,6 +212,7 @@ memarea_alloc(memarea_t *area, size_t sz) char *result; tor_assert(chunk); CHECK_SENTINEL(chunk); + tor_assert(sz < SIZE_T_CEILING); if (sz == 0) sz = 1; if (chunk->next_mem+sz > chunk->u.mem+chunk->mem_size) { @@ -269,6 +271,7 @@ memarea_strndup(memarea_t *area, const char *s, size_t n) size_t ln; char *result; const char *cp, *end = s+n; + tor_assert(n < SIZE_T_CEILING); for (cp = s; cp < end && *cp; ++cp) ; /* cp now points to s+n, or to the 0 in the string. */ |