diff options
| author | Vladimir Vukicevic <vladimir@pobox.com> | 2007-06-19 13:15:21 -0700 |
|---|---|---|
| committer | Vladimir Vukicevic <vladimir@feisty.(none)> | 2007-06-29 09:46:08 -0700 |
| commit | 5c7d2d14d78e4dfb1ef6d2c40f0910f177e07360 (patch) | |
| tree | bb1abcb2f1144059d4444d8db343014e07791593 /src/cairo-polygon.c | |
| parent | fc34073464c487405b6e2e0a5fa269a1ae15a02a (diff) | |
| download | cairo-5c7d2d14d78e4dfb1ef6d2c40f0910f177e07360.tar.gz | |
[fix] Avoid int overflow when allocating large buffers
This patch introduces three macros: _cairo_malloc_ab,
_cairo_malloc_abc, _cairo_malloc_ab_plus_c and replaces various calls
to malloc(a*b), malloc(a*b*c), and malloc(a*b+c) with them. The macros
return NULL if int overflow would occur during the allocation. See
CODING_STYLE for more information.
Diffstat (limited to 'src/cairo-polygon.c')
| -rw-r--r-- | src/cairo-polygon.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/cairo-polygon.c b/src/cairo-polygon.c index e9fc78b79..726884a9e 100644 --- a/src/cairo-polygon.c +++ b/src/cairo-polygon.c @@ -93,7 +93,7 @@ _cairo_polygon_grow (cairo_polygon_t *polygon) assert (polygon->num_edges <= polygon->edges_size); if (polygon->edges == polygon->edges_embedded) { - new_edges = malloc (new_size * sizeof (cairo_edge_t)); + new_edges = _cairo_malloc_ab (new_size, sizeof (cairo_edge_t)); if (new_edges) memcpy (new_edges, polygon->edges, old_size * sizeof (cairo_edge_t)); } else { |