diff options
| author | Phil Pennock <phil+git@pennock-tech.com> | 2020-10-29 21:30:04 -0400 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-04-28 00:40:22 +0200 |
| commit | 9f06dcd6848052f2524658bf871c60a8d48c7dbe (patch) | |
| tree | 7a709806830362c5240ce8ddc3d5ee482275628b | |
| parent | 6f5d7e5af8eff688c36f81334e4f063689561963 (diff) | |
| download | exim4-9f06dcd6848052f2524658bf871c60a8d48c7dbe.tar.gz | |
SECURITY: a second negative store guard
(cherry picked from commit 706864e934c70941ce7a327f97b7649a1e5f5556)
| -rw-r--r-- | src/src/store.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/src/store.c b/src/src/store.c index 90da012fb..1e6259c18 100644 --- a/src/src/store.c +++ b/src/src/store.c @@ -390,6 +390,13 @@ int pool = tainted ? store_pool + POOL_TAINT_BASE : store_pool; int inc = newsize - oldsize; int rounded_oldsize = oldsize; +if (newsize < 0) + { + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "bad memory extension requested (%d -> %d bytes) at %s %d", + oldsize, newsize, func, linenumber); + } + /* Check that the block being extended was already of the required taint status; refuse to extend if not. */ |