Check for mpz_t overflow.

1 files changed, 20 insertions, 1 deletions

diff --git a/mpz/realloc2.c b/mpz/realloc2.c
index aa5e26fa6..422c83890 100644
--- a/mpz/realloc2.c
+++ b/mpz/realloc2.c
@@ -1,6 +1,6 @@
 /* mpz_realloc2 -- change allocated data size.
 
-Copyright 2001, 2002 Free Software Foundation, Inc.
+Copyright 2001, 2002, 2008 Free Software Foundation, Inc.
 
 This file is part of the GNU MP Library.
 
@@ -17,6 +17,8 @@ License for more details.
 You should have received a copy of the GNU Lesser General Public License
 along with the GNU MP Library.  If not, see http://www.gnu.org/licenses/.  */
 
+#include <stdlib.h>
+#include <stdio.h>
 #include "gmp.h"
 #include "gmp-impl.h"
 
@@ -31,6 +33,23 @@ mpz_realloc2 (mpz_ptr m, unsigned long bits)
   /* Never allocate zero space. */
   new_alloc = MAX (new_alloc, 1);
 
+  if (sizeof (mp_size_t) == sizeof (int))
+    {
+      if (UNLIKELY (new_alloc > INT_MAX / GMP_NUMB_BITS))
+	{
+	  fprintf (stderr, "gmp: overflow in mpz type\n");
+	  abort ();
+	}
+    }
+  else
+    {
+      if (UNLIKELY (new_alloc > INT_MAX))
+	{
+	  fprintf (stderr, "gmp: overflow in mpz type\n");
+	  abort ();
+	}
+    }
+
   mp = __GMP_REALLOCATE_FUNC_LIMBS (PTR(m), ALLOC(m), new_alloc);
   PTR(m) = mp;
   ALLOC(m) = new_alloc;