diff options
| author | Marcus Meissner <meissner@suse.de> | 2019-04-21 15:14:09 +0200 |
|---|---|---|
| committer | Marcus Meissner <meissner@suse.de> | 2019-04-21 15:14:09 +0200 |
| commit | 13f7893c5a2b64560d2d93a345728d3149ef6074 (patch) | |
| tree | b17501866374192ad857c5c2baabef2b33191a5a /camlibs/ricoh | |
| parent | 6f6bf0b97de64d84bc01e9b05da56539f2d1f32c (diff) | |
| download | libgphoto2-13f7893c5a2b64560d2d93a345728d3149ef6074.tar.gz | |
handle NULL malloc return on large sizes (AFL)
Diffstat (limited to 'camlibs/ricoh')
| -rw-r--r-- | camlibs/ricoh/g3.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/camlibs/ricoh/g3.c b/camlibs/ricoh/g3.c index cce3e697f..096f27ce8 100644 --- a/camlibs/ricoh/g3.c +++ b/camlibs/ricoh/g3.c @@ -77,6 +77,10 @@ g3_channel_read(GPPort *port, int *channel, char **buffer, unsigned int *len) *buffer = malloc(*len + 1 + 0x800); else *buffer = realloc(*buffer, *len + 1 + 0x800); + if (!*buffer) { + gp_log(GP_LOG_ERROR, "g3" ,"malloc failed, size %d too large?\n", *len+1+0x800); + return GP_ERROR_NO_MEMORY; + } tocopy = *len; if (tocopy > 0x800-8) tocopy = 0x800-8; memcpy(*buffer, xbuf+8, tocopy); |