diff options
Diffstat (limited to 'src/lib/libcrypto/buffer/buffer.c')
| -rw-r--r-- | src/lib/libcrypto/buffer/buffer.c | 33 | 
1 files changed, 16 insertions, 17 deletions
| diff --git a/src/lib/libcrypto/buffer/buffer.c b/src/lib/libcrypto/buffer/buffer.c index f15b93d26c..5ed893f5f9 100644 --- a/src/lib/libcrypto/buffer/buffer.c +++ b/src/lib/libcrypto/buffer/buffer.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: buffer.c,v 1.25 2017/04/09 15:03:54 jsing Exp $ */ | 1 | /* $OpenBSD: buffer.c,v 1.26 2017/04/09 15:06:20 jsing Exp $ */ | 
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 
| 3 | * All rights reserved. | 3 | * All rights reserved. | 
| 4 | * | 4 | * | 
| @@ -63,9 +63,11 @@ | |||
| 63 | #include <openssl/buffer.h> | 63 | #include <openssl/buffer.h> | 
| 64 | #include <openssl/err.h> | 64 | #include <openssl/err.h> | 
| 65 | 65 | ||
| 66 | /* LIMIT_BEFORE_EXPANSION is the maximum n such that (n+3)/3*4 < 2**31. That | 66 | /* | 
| 67 | * function is applied in several functions in this file and this limit ensures | 67 | * LIMIT_BEFORE_EXPANSION is the maximum n such that (n + 3) / 3 * 4 < 2**31. | 
| 68 | * that the result fits in an int. */ | 68 | * That function is applied in several functions in this file and this limit | 
| 69 | * ensures that the result fits in an int. | ||
| 70 | */ | ||
| 69 | #define LIMIT_BEFORE_EXPANSION 0x5ffffffc | 71 | #define LIMIT_BEFORE_EXPANSION 0x5ffffffc | 
| 70 | 72 | ||
| 71 | BUF_MEM * | 73 | BUF_MEM * | 
| @@ -106,30 +108,27 @@ BUF_MEM_grow_clean(BUF_MEM *str, size_t len) | |||
| 106 | char *ret; | 108 | char *ret; | 
| 107 | size_t n; | 109 | size_t n; | 
| 108 | 110 | ||
| 109 | if (str->length >= len) { | ||
| 110 | memset(&str->data[len], 0, str->length - len); | ||
| 111 | str->length = len; | ||
| 112 | return (len); | ||
| 113 | } | ||
| 114 | if (str->max >= len) { | 111 | if (str->max >= len) { | 
| 112 | if (str->length >= len) | ||
| 113 | memset(&str->data[len], 0, str->length - len); | ||
| 115 | str->length = len; | 114 | str->length = len; | 
| 116 | return (len); | 115 | return (len); | 
| 117 | } | 116 | } | 
| 118 | /* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */ | 117 | |
| 119 | if (len > LIMIT_BEFORE_EXPANSION) { | 118 | if (len > LIMIT_BEFORE_EXPANSION) { | 
| 120 | BUFerror(ERR_R_MALLOC_FAILURE); | 119 | BUFerror(ERR_R_MALLOC_FAILURE); | 
| 121 | return 0; | 120 | return 0; | 
| 122 | } | 121 | } | 
| 122 | |||
| 123 | n = (len + 3) / 3 * 4; | 123 | n = (len + 3) / 3 * 4; | 
| 124 | ret = recallocarray(str->data, str->max, n, 1); | 124 | if ((ret = recallocarray(str->data, str->max, n, 1)) == NULL) { | 
| 125 | if (ret == NULL) { | ||
| 126 | BUFerror(ERR_R_MALLOC_FAILURE); | 125 | BUFerror(ERR_R_MALLOC_FAILURE); | 
| 127 | len = 0; | 126 | return (0); | 
| 128 | } else { | ||
| 129 | str->data = ret; | ||
| 130 | str->max = n; | ||
| 131 | str->length = len; | ||
| 132 | } | 127 | } | 
| 128 | str->data = ret; | ||
| 129 | str->max = n; | ||
| 130 | str->length = len; | ||
| 131 | |||
| 133 | return (len); | 132 | return (len); | 
| 134 | } | 133 | } | 
| 135 | 134 | ||
