diff options
author | Bram Moolenaar <Bram@vim.org> | 2020-10-13 21:11:13 +0200 |
---|---|---|
committer | Bram Moolenaar <Bram@vim.org> | 2020-10-13 21:11:13 +0200 |
commit | b9616af23f31fc18721a92643c21f42b69854efe (patch) | |
tree | 5bbf78403a5731ac2d8c26aa74690e73e321a9a3 /src/netbeans.c | |
parent | 21cbe175eece17fad21d7403b00422445b587138 (diff) |
patch 8.2.1843: Netbeans: with huge buffer number memory allocation may failv8.2.1843
Problem: Netbeans: with huge buffer number memory allocation may fail.
Solution: Check for size overflow.
Diffstat (limited to 'src/netbeans.c')
-rw-r--r-- | src/netbeans.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/netbeans.c b/src/netbeans.c index ad049a27da..ccff3a5367 100644 --- a/src/netbeans.c +++ b/src/netbeans.c @@ -674,11 +674,19 @@ nb_get_buf(int bufno) { if (bufno >= buf_list_size) // grow list { - nbbuf_T *t_buf_list = buf_list; + nbbuf_T *t_buf_list = buf_list; + size_t bufsize; incr = bufno - buf_list_size + 90; buf_list_size += incr; - buf_list = vim_realloc(buf_list, buf_list_size * sizeof(nbbuf_T)); + bufsize = buf_list_size * sizeof(nbbuf_T); + if (bufsize == 0 || bufsize / sizeof(nbbuf_T) + != (size_t)buf_list_size) + { + // list size overflow, bail out + return NULL; + } + buf_list = vim_realloc(buf_list, bufsize); if (buf_list == NULL) { vim_free(t_buf_list); |