libc; fix integer overflow of alloc size due to multiplication.
Pointed out by
#include <stdlib.h>
#include <string.h>
-
-/* FIXME: This should look for multiplication overflow */
+#include <stdint.h>
void *calloc(size_t nmemb, size_t size)
{
void *ptr;
+ int nb;
+ nb = sizeof(size_t) * 4;
+ if (size >= SIZE_MAX >> nb || nmemb >= SIZE_MAX >> nb) {
+ return NULL;
+ }
size *= nmemb;
ptr = malloc(size);
if (ptr)
