guard getdelim buffer growth against size_t overflow

1 files changed, 6 insertions, 0 deletions

diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c
index 9bacf0c..bf4889f 100644
--- a/crypto/compat/getdelim.c
+++ b/crypto/compat/getdelim.c
@@ -27,6 +27,8 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <errno.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 
@@ -66,6 +68,10 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
                 }
                 if (ptr + 2 >= eptr) {
                         ssize_t d = ptr - *buf;
+                        if (*bufsiz > SIZE_MAX / 2) {
+                                errno = EOVERFLOW;
+                                return -1;
+                        }
                         nbufsiz = *bufsiz * 2;
                         if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
                                 return -1;