diff options
author | Stanislav Malyshev <stas@php.net> | 2012-06-08 01:21:37 -0700 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2012-06-08 01:21:37 -0700 |
commit | fc74503792b1ee92e4b813690890f3ed38fa3ad5 (patch) | |
tree | a0340002fee20fe8acdeae560fc43a3f9ed87998 /main | |
parent | 7d04e0fb2ec8be9b1c4b16a9f0b4958f853597f1 (diff) | |
download | php-git-fc74503792b1ee92e4b813690890f3ed38fa3ad5.tar.gz |
improve overflow checks
Diffstat (limited to 'main')
-rwxr-xr-x | main/streams/streams.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/main/streams/streams.c b/main/streams/streams.c index 43cb0104f3..dfd60940fc 100755 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -2279,6 +2279,11 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_ if (vector_size == 0) { vector_size = 10; } else { + if(vector_size*2 < vector_size) { + /* overflow */ + efree(vector); + return FAILURE; + } vector_size *= 2; } vector = (char **) safe_erealloc(vector, vector_size, sizeof(char *), 0); @@ -2287,11 +2292,6 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_ vector[nfiles] = estrdup(sdp.d_name); nfiles++; - if(vector_size < 10 || nfiles == 0) { - /* overflow */ - efree(vector); - return FAILURE; - } } php_stream_closedir(stream); |