[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
split.c - size_t overflow
|
From: |
Chris Penev |
|
Subject: |
split.c - size_t overflow |
|
Date: |
Sat, 7 Mar 2009 20:43:06 -0800 |
Line 153 - 157
...
153: size_t outbase_length = strlen (outbase);
154: size_t outfile_length = outbase_length + suffix_length;
155: if (outfile_length + 1 < outbase_length)
156: xalloc_die ();
157: outfile = xmalloc (outfile_length + 1);
...
If suffix_length SIZE_MAX the check on line 155 is bypassed.
- split.c - size_t overflow,
Chris Penev <=