Add a check to prevent a possible integer wrap that would lead to an invalid array access.

1 files changed, 8 insertions, 0 deletions

diff --git a/TAO/tao/Unbounded_Reference_Allocation_Traits_T.h b/TAO/tao/Unbounded_Reference_Allocation_Traits_T.h
index f4b45795f6a..518e876a26a 100644
--- a/TAO/tao/Unbounded_Reference_Allocation_Traits_T.h
+++ b/TAO/tao/Unbounded_Reference_Allocation_Traits_T.h
@@ -36,6 +36,10 @@ struct unbounded_reference_allocation_traits
 
   inline static value_type * allocbuf(CORBA::ULong maximum)
   {
+    if (maximum == ACE_UINT32_MAX)
+      {
+        return 0;
+      }
     value_type * buffer = new value_type[maximum + 1];
     reinterpret_cast<value_type**>(buffer)[0] = buffer + maximum + 1;
 
@@ -47,6 +51,10 @@ struct unbounded_reference_allocation_traits
 
   inline static value_type * allocbuf_noinit(CORBA::ULong maximum)
   {
+    if (maximum == ACE_UINT32_MAX)
+      {
+        return 0;
+      }
     value_type * buffer = new value_type[maximum + 1];
     reinterpret_cast<value_type**>(buffer)[0] = buffer + maximum + 1;