Skip to content

#1331: buffer overflow fix

Mark Weaver requested to merge blushingpenguin/glib:main into main

This PR resurrects the buffer overflow (due to integer overflow) fixes for #1331 (closed) written by Tomasz Miąsko.

If this isn't an acceptable approach then I can provide a simpler version that doesn't attempt to extend the amount of data GArray can handle but just fixes the existing buffer overflow, see: overflow.patch instead for an example of this problem. This test causes SIGSEGV because the overflow check is only testing the number of array entries, but is then computing the desired total to allocate as elt_size * len(array) and casting that to a guint, so it wraps if the total > 4gb.

Fixes: #1331 (closed)

Edited by Philip Withnall

Merge request reports