Skip to content

W
wine-winehq
Commit c3b4fe39 authored by Rob Shearman's avatar Rob Shearman Committed by Alexandre Julliard
Browse files
Options

kernel32: Protect global alloc functions against integer overflows on the size parameter.

parent fb883d86
Show whitespace changes
Inline Side-by-side
Showing with 18 additions and 2 deletions
dlls/kernel32/heap.c
View file @ c3b4fe39
......@@ -365,6 +365,12 @@ HGLOBAL WINAPI GlobalAlloc(
}
else /* HANDLE */
{
if (size > INT_MAX-HGLOBAL_STORAGE)
{
SetLastError(ERROR_OUTOFMEMORY);
return 0;
}
RtlLockHeap(GetProcessHeap());
pintern = HeapAlloc(GetProcessHeap(), 0, sizeof(GLOBAL32_INTERN));
......@@ -658,7 +664,12 @@ HGLOBAL WINAPI GlobalReAlloc(
hnew=hmem;
if(pintern->Pointer)
{
if((palloc = HeapReAlloc(GetProcessHeap(), heap_flags,
if(size > INT_MAX-HGLOBAL_STORAGE)
{
SetLastError(ERROR_OUTOFMEMORY);
hnew = 0;
}
else if((palloc = HeapReAlloc(GetProcessHeap(), heap_flags,
(char *) pintern->Pointer-HGLOBAL_STORAGE,
size+HGLOBAL_STORAGE)) == NULL)
hnew = 0; /* Block still valid */
......@@ -667,7 +678,12 @@ HGLOBAL WINAPI GlobalReAlloc(
}
else
{
if((palloc=HeapAlloc(GetProcessHeap(), heap_flags, size+HGLOBAL_STORAGE))
if(size > INT_MAX-HGLOBAL_STORAGE)
{
SetLastError(ERROR_OUTOFMEMORY);
hnew = 0;
}
else if((palloc=HeapAlloc(GetProcessHeap(), heap_flags, size+HGLOBAL_STORAGE))
== NULL)
hnew = 0;
else
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment