* renamed malloc.h mymalloc.h, and added MALLARG as the type of the

  argument to malloc() (size_t or unsigned int)

* listobject.c: check for overflow of the size of the object,
  so things like range(0x7fffffff) will raise MemoryError instead
  of calling malloc() with -4 (and then crashing -- malloc's fault)

4 files changed, 83 insertions, 3 deletions

diff --git a/Include/allobjects.h b/Include/allobjects.h
index 348f04e6a7..dd78a83f06 100644
--- a/Include/allobjects.h
+++ b/Include/allobjects.h
@@ -50,7 +50,7 @@ OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #include "fileobject.h"
 
 #include "errors.h"
-#include "malloc.h"
+#include "mymalloc.h"
 
 extern char *strdup PROTO((const char *));
 extern void fatal PROTO((char *));
diff --git a/Include/mymalloc.h b/Include/mymalloc.h
new file mode 100644
index 0000000000..aadd0f3048
--- /dev/null
+++ b/Include/mymalloc.h
@@ -0,0 +1,74 @@
+/***********************************************************
+Copyright 1991, 1992 by Stichting Mathematisch Centrum, Amsterdam, The
+Netherlands.
+
+                        All Rights Reserved
+
+Permission to use, copy, modify, and distribute this software and its 
+documentation for any purpose and without fee is hereby granted, 
+provided that the above copyright notice appear in all copies and that
+both that copyright notice and this permission notice appear in 
+supporting documentation, and that the names of Stichting Mathematisch
+Centrum or CWI not be used in advertising or publicity pertaining to
+distribution of the software without specific, written prior permission.
+
+STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO
+THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE
+FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+******************************************************************/
+
+/* Lowest-level memory allocation interface */
+
+#ifdef macintosh
+#define ANY void
+#ifndef THINK_C_3_0
+#define HAVE_STDLIB
+#endif
+#endif
+
+#ifdef sun
+/* Maybe not for very old versions of SunOS ? */
+#define HAVE_STDLIB
+#endif
+
+#ifdef sgi
+#define HAVE_STDLIB
+#endif
+
+#ifdef __STDC__
+#define ANY void
+#define HAVE_STDLIB
+#endif
+
+#ifndef ANY
+#define ANY char
+#endif
+
+#ifndef NULL
+#define NULL 0
+#endif
+
+#define NEW(type, n) ( (type *) malloc((n) * sizeof(type)) )
+#define RESIZE(p, type, n) \
+	if ((p) == NULL) \
+		(p) =  (type *) malloc((n) * sizeof(type)); \
+	else \
+		(p) = (type *) realloc((ANY *)(p), (n) * sizeof(type))
+#define DEL(p) free((ANY *)p)
+#define XDEL(p) if ((p) == NULL) ; else DEL(p)
+
+#ifdef HAVE_STDLIB
+#include <stdlib.h>
+#define MALLARG size_t
+#else
+#define MALLARG size_t
+extern ANY *malloc PROTO((MALLARG));
+extern ANY *calloc PROTO((MALLARG, MALLARG));
+extern ANY *realloc PROTO((ANY *, MALLARG));
+extern void free PROTO((ANY *)); /* XXX sometimes int on Unix old systems */
+#endif
diff --git a/Include/pgenheaders.h b/Include/pgenheaders.h
index 42319cddf9..86071420eb 100644
--- a/Include/pgenheaders.h
+++ b/Include/pgenheaders.h
@@ -49,6 +49,6 @@ OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #endif
 
 #include "PROTO.h"
-#include "malloc.h"
+#include "mymalloc.h"
 
 extern void fatal PROTO((char *));
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 0f517359de..c032532284 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -34,10 +34,16 @@ newlistobject(size)
 {
 	int i;
 	listobject *op;
+	MALLARG nbytes;
 	if (size < 0) {
 		err_badcall();
 		return NULL;
 	}
+	nbytes = size * sizeof(object *);
+	/* Check for overflow */
+	if (nbytes / sizeof(object *) != size) {
+		return err_nomem();
+	}
 	op = (listobject *) malloc(sizeof(listobject));
 	if (op == NULL) {
 		return err_nomem();
@@ -46,7 +52,7 @@ newlistobject(size)
 		op->ob_item = NULL;
 	}
 	else {
-		op->ob_item = (object **) malloc(size * sizeof(object *));
+		op->ob_item = (object **) malloc(nbytes);
 		if (op->ob_item == NULL) {
 			free((ANY *)op);
 			return err_nomem();