[malloc] Check for integer overflow when realloc'ing.

Perform similar sanity checks to Vlad's _cairo_malloc_ab() but on the
arguments to realloc instead.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/cairo-lzw.c b/src/cairo-lzw.c
index 370d258b5..36a59fda6 100644
--- a/src/cairo-lzw.c
+++ b/src/cairo-lzw.c
@@ -93,7 +93,11 @@ _lzw_buf_grow (lzw_buf_t *buf)
     if (buf->status)
 	return buf->status;
 
-    new_data = realloc (buf->data, new_size);
+    new_data = NULL;
+    /* check for integer overflow */
+    if (new_size / 2 == buf->data_size)
+	new_data = realloc (buf->data, new_size);
+
     if (new_data == NULL) {
 	free (buf->data);
 	buf->data_size = 0;