- Add safe_pemalloc()

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 4415ae3aa13d71b59f03d5323268d62ea5e6aaf7..b234bc8203e85b6ed81492f5e6299281efb2f2ef 100644 (file)
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -241,6 +241,30 @@ ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_
        return 0;
 }
 
+ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset)
+{
+
+       if (nmemb < LONG_MAX
+                       && size < LONG_MAX
+                       && offset < LONG_MAX
+                       && nmemb >= 0
+                       && size >= 0
+                       && offset >= 0) {
+               long lval;
+               double dval;
+               int use_dval;
+
+               ZEND_SIGNED_MULTIPLY_LONG(nmemb, size, lval, dval, use_dval);
+
+               if (!use_dval
+                               && lval < (long) (LONG_MAX - offset)) {
+                       return pemalloc(lval + offset, 1);
+               }
+       }
+
+       zend_error(E_ERROR, "Possible integer overflow in memory allocation (%zd * %zd + %zd)", nmemb, size, offset);
+       return 0;
+}
 
 
 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)

diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
index 7521787ab85efdd7e037e5223da0cd3b0aa661be..1cc09385bddfffb2dffdafaa9ff5cd906590fba8 100644 (file)
--- a/Zend/zend_alloc.h
+++ b/Zend/zend_alloc.h
@@ -78,6 +78,7 @@ ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_M
 
 ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
+ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
 ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
@@ -106,6 +107,7 @@ ZEND_API char *_estrndup(const char *s, unsigned int length ZEND_FILE_LINE_DC ZE
 
 /* Selective persistent/non persistent allocation macros */
 #define pemalloc(size, persistent) ((persistent)?malloc(size):emalloc(size))
+#define safe_pemalloc(nmemb, size, offset, persistent) ((persistent)?_safe_malloc(nmemb, size, offset):safe_emalloc(nmemb, size, offset))
 #define pefree(ptr, persistent)  ((persistent)?free(ptr):efree(ptr))
 #define pecalloc(nmemb, size, persistent) ((persistent)?calloc((nmemb), (size)):ecalloc((nmemb), (size)))
 #define perealloc(ptr, size, persistent) ((persistent)?realloc((ptr), (size)):erealloc((ptr), (size)))