Try to catch a couple of cases in which parameters for malloc calls

could overflow.  Thanks to Timo Sirainen for the heads-up.

diff --git a/browser.c b/browser.c
index b94ba6537e385a0ecc34b684c3a403336dbb2966..1ee315f0ed25e198580c4961eb44673a390f2a74 100644 (file)
--- a/browser.c
+++ b/browser.c
@@ -797,7 +797,7 @@ void _mutt_select_file (char *f, size_t flen, int flags, char ***files, int *num
          if (menu->tagged)
          {
            *numfiles = menu->tagged;
-           tfiles = safe_malloc (*numfiles * sizeof (char *));
+           tfiles = safe_calloc (*numfiles, sizeof (char *));
            for (i = 0, j = 0; i < state.entrylen; i++)
            {
              struct folder_file ff = state.entry[i];
@@ -814,7 +814,7 @@ void _mutt_select_file (char *f, size_t flen, int flags, char ***files, int *num
          else if (f[0]) /* no tagged entries. return selected entry */
          {
            *numfiles = 1;
-           tfiles = safe_malloc (*numfiles * sizeof (char *));
+           tfiles = safe_calloc (*numfiles, sizeof (char *));
            mutt_expand_path (f, flen);
            tfiles[0] = safe_strdup (f);
            *files = tfiles;

diff --git a/enter.c b/enter.c
index 5b956bf1dce581eaa5e4f047a2cc7bdacaddeee4..56dcb25787bcc7ec50cd5213a5c06d6cbd8a6c13 100644 (file)
--- a/enter.c
+++ b/enter.c
@@ -148,7 +148,7 @@ static void replace_part (ENTER_STATE *state, size_t from, char *buf)
 {
   /* Save the suffix */
   size_t savelen = state->lastchar - state->curpos;
-  wchar_t *savebuf = safe_malloc (savelen * sizeof (wchar_t));
+  wchar_t *savebuf = safe_calloc (savelen, sizeof (wchar_t));
   memcpy (savebuf, state->wbuf + state->curpos, savelen * sizeof (wchar_t));
 
   /* Convert to wide characters */
@@ -657,7 +657,7 @@ self_insert:
        {
          char **tfiles;
          *numfiles = 1;
-         tfiles = safe_malloc (*numfiles * sizeof (char *));
+         tfiles = safe_calloc (*numfiles, sizeof (char *));
          mutt_expand_path (buf, buflen);
          tfiles[0] = safe_strdup (buf);
          *files = tfiles;

diff --git a/imap/imap.c b/imap/imap.c
index 18852aa1bcf9984a250ea2028b9cdc5519d8518d..42e5746f8044f502bd29fa74c5cc043f2470e1b8 100644 (file)
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -665,8 +665,8 @@ int imap_open_mailbox (CONTEXT* ctx)
   }
 
   ctx->hdrmax = count;
-  ctx->hdrs = safe_malloc (count * sizeof (HEADER *));
-  ctx->v2r = safe_malloc (count * sizeof (int));
+  ctx->hdrs = safe_calloc (count, sizeof (HEADER *));
+  ctx->v2r = safe_calloc (count, sizeof (int));
   ctx->msgcount = 0;
   if (count && (imap_read_headers (idata, 0, count-1) < 0))
   {

diff --git a/lib.c b/lib.c
index 2a7e92ccec09fa70d6f2a527b4ecde04cdcbb9be..b40cc9cb1d26ab749ce97feeaff55b2cfdb26814 100644 (file)
--- a/lib.c
+++ b/lib.c
@@ -52,6 +52,13 @@ void *safe_calloc (size_t nmemb, size_t size)
 {
   void *p;
 
+  if (((size_t) -1) / nmemb <= size)
+  {
+    mutt_error _("Integer overflow -- can't allocate memory!");
+    sleep (1);
+    mutt_exit (1);
+  }
+  
   if (!nmemb || !size)
     return NULL;
   if (!(p = calloc (nmemb, size)))

diff --git a/mutt_idna.c b/mutt_idna.c
index fc3aec5f7fbc364dc87a56f85d05eb6a51659f59..b6d3140ed678d399a09b32d247bc7440e9d0b096 100644 (file)
--- a/mutt_idna.c
+++ b/mutt_idna.c
@@ -127,7 +127,7 @@ static int mbox_to_udomain (const char *mbx, char **user, char **domain)
   p = strchr (mbx, '@');
   if (!p)
     return -1;
-  *user = safe_malloc((p - mbx + 1) * sizeof(mbx[0]));
+  *user = safe_calloc((p - mbx + 1), sizeof(mbx[0]));
   strfcpy (*user, mbx, (p - mbx + 1));
   *domain = safe_strdup(p + 1);
   return 0;

diff --git a/mx.c b/mx.c
index 59f577d5402a142531473c868270009e778246c6..c00444f02b5d6598ec0c02f7cbc6411b2f615f0a 100644 (file)
--- a/mx.c
+++ b/mx.c
@@ -1537,7 +1537,15 @@ int mx_close_message (MESSAGE **msg)
 void mx_alloc_memory (CONTEXT *ctx)
 {
   int i;
-
+  size_t s = MAX (sizeof (HEADER *), sizeof (int));
+  
+  if ((ctx->hdrmax + 25) * s < ctx->hdrmax * s)
+  {
+    mutt_error _("Integer overflow -- can't allocate memory.");
+    sleep (1);
+    mutt_exit (1);
+  }
+  
   if (ctx->hdrs)
   {
     safe_realloc ((void **) &ctx->hdrs, sizeof (HEADER *) * (ctx->hdrmax += 25));
@@ -1545,8 +1553,8 @@ void mx_alloc_memory (CONTEXT *ctx)
   }
   else
   {
-    ctx->hdrs = safe_malloc (sizeof (HEADER *) * (ctx->hdrmax += 25));
-    ctx->v2r = safe_malloc (sizeof (int) * ctx->hdrmax);
+    ctx->hdrs = safe_calloc ((ctx->hdrmax += 25), sizeof (HEADER *));
+    ctx->v2r = safe_calloc (ctx->hdrmax, sizeof (int));
   }
   for (i = ctx->msgcount ; i < ctx->hdrmax ; i++)
   {

diff --git a/sendlib.c b/sendlib.c
index acd1f1e889705bc9ac6008caf36923fa4db40957..84ee8928f8ef7875fb9c42fe9d45bb43f689fab5 100644 (file)
--- a/sendlib.c
+++ b/sendlib.c
@@ -690,10 +690,10 @@ static size_t convert_file_to (FILE *file, const char *fromcode,
   if (cd1 == (iconv_t)(-1))
     return -1;
 
-  cd     = safe_malloc (ncodes * sizeof (iconv_t));
-  score  = safe_calloc (1, ncodes * sizeof (size_t));
-  states = safe_calloc (1, ncodes * sizeof (CONTENT_STATE));
-  infos  = safe_calloc (1, ncodes * sizeof (CONTENT));
+  cd     = safe_calloc (ncodes, sizeof (iconv_t));
+  score  = safe_calloc (ncodes, sizeof (size_t));
+  states = safe_calloc (ncodes, sizeof (CONTENT_STATE));
+  infos  = safe_calloc (ncodes, sizeof (CONTENT));
 
   for (i = 0; i < ncodes; i++)
     if (ascii_strcasecmp (tocodes[i], "UTF-8"))

diff --git a/smime.c b/smime.c
index 58755408ac41162d67fd53bbc16a9ec8de9c899c..e342fb0d55e20481bbfa0d9e656226b014235732 100644 (file)
--- a/smime.c
+++ b/smime.c
@@ -379,7 +379,7 @@ char* smime_ask_for_key (char *prompt, char *mailbox, short public)
     }
     /* Read Entries */
     cur = 0;
-    Table = safe_malloc(sizeof (smime_id) * cert_num);
+    Table = safe_calloc(cert_num, sizeof (smime_id));
     while (!feof(index)) {
         numFields = fscanf (index, MUTT_FORMAT(STRING) " %x.%i " MUTT_FORMAT(STRING), fields[0], &hash,
           &hash_suffix, fields[2]);

diff --git a/thread.c b/thread.c
index 0896c24f006b5bb0e718183cddd895ee34cd8707..bd45392f6d51e344a49c468be8ac87edc8f10433 100644 (file)
--- a/thread.c
+++ b/thread.c
@@ -591,7 +591,7 @@ THREAD *mutt_sort_subthreads (THREAD *thread, int init)
 
   top = thread;
 
-  array = safe_malloc ((array_size = 256) * sizeof (THREAD *));
+  array = safe_calloc ((array_size = 256), sizeof (THREAD *));
   while (1)
   {
     if (init || !thread->sort_key)