diff options
| author | Roger Dingledine <arma@torproject.org> | 2010-12-16 16:59:12 -0500 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2010-12-16 16:59:12 -0500 |
| commit | 975ffe439889300783e0607dd20fce550f418ff5 (patch) | |
| tree | 52cd8a4410e5d69ecd627b7ad25d2973ba7d3362 /src/common/memarea.c | |
| parent | 3c3b1d14fd1031c244c62fd16dac0dff53cb069f (diff) | |
| parent | b0def605a52b3acce1cb212f270b184d72f237f5 (diff) | |
| download | tor-975ffe439889300783e0607dd20fce550f418ff5.tar.gz tor-975ffe439889300783e0607dd20fce550f418ff5.zip | |
Merge commit 'nickm/fix_security_bug_021' into maint-0.2.1
Diffstat (limited to 'src/common/memarea.c')
| -rw-r--r-- | src/common/memarea.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/common/memarea.c b/src/common/memarea.c index 9d908bae50..edd7bbe9ef 100644 --- a/src/common/memarea.c +++ b/src/common/memarea.c @@ -73,6 +73,7 @@ static memarea_chunk_t *freelist = NULL; static memarea_chunk_t * alloc_chunk(size_t sz, int freelist_ok) { + tor_assert(sz < SIZE_T_CEILING); if (freelist && freelist_ok) { memarea_chunk_t *res = freelist; freelist = res->next_chunk; @@ -182,6 +183,7 @@ memarea_alloc(memarea_t *area, size_t sz) memarea_chunk_t *chunk = area->first; char *result; tor_assert(chunk); + tor_assert(sz < SIZE_T_CEILING); if (sz == 0) sz = 1; if (chunk->next_mem+sz > chunk->u.mem+chunk->mem_size) { @@ -240,6 +242,7 @@ memarea_strndup(memarea_t *area, const char *s, size_t n) size_t ln; char *result; const char *cp, *end = s+n; + tor_assert(n < SIZE_T_CEILING); for (cp = s; cp < end && *cp; ++cp) ; /* cp now points to s+n, or to the 0 in the string. */ |