svn commit: r204928 - head/usr.bin/comm

[Andrey A. Chernov]

Author: ache
Date: Tue Mar  9 21:06:17 2010
New Revision: 204928
URL: http://svn.freebsd.org/changeset/base/204928

Log:
  Add SIZE_MAX overflow check

Modified:
  head/usr.bin/comm/comm.c

Modified: head/usr.bin/comm/comm.c
==============================================================================
--- head/usr.bin/comm/comm.c	Tue Mar  9 21:06:01 2010	(r204927)
+++ head/usr.bin/comm/comm.c	Tue Mar  9 21:06:17 2010	(r204928)
@@ -201,6 +201,8 @@ convert(const char *str)
 
 	if ((n = mbstowcs(NULL, str, 0)) == (size_t)-1)
 		return (NULL);
+	if (SIZE_MAX / sizeof(*buf) < n + 1)
+		errx(1, "conversion buffer length overflow");
 	if ((buf = malloc((n + 1) * sizeof(*buf))) == NULL)
 		err(1, "malloc");
 	if (mbstowcs(buf, str, n + 1) != n)