check for size < 0 when allocating memory, from openssl (-r1.34)

2 files changed, 12 insertions, 0 deletions

diff --git a/src/lib/libcrypto/mem.c b/src/lib/libcrypto/mem.c
index a7826908e6..87d0ebc714 100644
--- a/src/lib/libcrypto/mem.c
+++ b/src/lib/libcrypto/mem.c
@@ -251,6 +251,8 @@ void *CRYPTO_malloc_locked(int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (num < 0) return NULL;
+
         allow_customize = 0;
         if (malloc_debug_func != NULL)
                 {
@@ -283,6 +285,8 @@ void *CRYPTO_malloc(int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (num < 0) return NULL;
+
         allow_customize = 0;
         if (malloc_debug_func != NULL)
                 {
@@ -306,6 +310,8 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         if (str == NULL)
                 return CRYPTO_malloc(num, file, line);
 
+        if (num < 0) return NULL;
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret = realloc_ex_func(str,num,file,line);
diff --git a/src/lib/libssl/src/crypto/mem.c b/src/lib/libssl/src/crypto/mem.c
index a7826908e6..87d0ebc714 100644
--- a/src/lib/libssl/src/crypto/mem.c
+++ b/src/lib/libssl/src/crypto/mem.c
@@ -251,6 +251,8 @@ void *CRYPTO_malloc_locked(int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (num < 0) return NULL;
+
         allow_customize = 0;
         if (malloc_debug_func != NULL)
                 {
@@ -283,6 +285,8 @@ void *CRYPTO_malloc(int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (num < 0) return NULL;
+
         allow_customize = 0;
         if (malloc_debug_func != NULL)
                 {
@@ -306,6 +310,8 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         if (str == NULL)
                 return CRYPTO_malloc(num, file, line);
 
+        if (num < 0) return NULL;
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret = realloc_ex_func(str,num,file,line);