aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2018-07-27 08:22:03 +0200
committerMarkus Armbruster <armbru@redhat.com>2018-07-28 09:09:58 +0200
commitb65ab77b3afadd7bb3051b341a5258ff7fb9d246 (patch)
tree4fb8a6190f0ec23c1ac90d1823b31d16a30ce5d9
parentad63c549ecd4af4a22a675a815edeb06b0e7bb6e (diff)
downloadqemu-arm-b65ab77b3afadd7bb3051b341a5258ff7fb9d246.tar.gz
qstring: Assert size calculations don't overflow
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180727062204.10401-2-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
-rw-r--r--qobject/qstring.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/qobject/qstring.c b/qobject/qstring.c
index 18b8eb82f8..1bb7784a88 100644
--- a/qobject/qstring.c
+++ b/qobject/qstring.c
@@ -41,17 +41,19 @@ QString *qstring_from_substr(const char *str, size_t start, size_t end)
{
QString *qstring;
+ assert(start <= end + 1);
+
qstring = g_malloc(sizeof(*qstring));
qobject_init(QOBJECT(qstring), QTYPE_QSTRING);
qstring->length = end - start + 1;
qstring->capacity = qstring->length;
+ assert(qstring->capacity < SIZE_MAX);
qstring->string = g_malloc(qstring->capacity + 1);
memcpy(qstring->string, str + start, qstring->length);
qstring->string[qstring->length] = 0;
-
return qstring;
}
@@ -68,7 +70,9 @@ QString *qstring_from_str(const char *str)
static void capacity_increase(QString *qstring, size_t len)
{
if (qstring->capacity < (qstring->length + len)) {
+ assert(len <= SIZE_MAX - qstring->capacity);
qstring->capacity += len;
+ assert(qstring->capacity <= SIZE_MAX / 2);
qstring->capacity *= 2; /* use exponential growth */
qstring->string = g_realloc(qstring->string, qstring->capacity + 1);