diff options
| author | drh <drh@noemail.net> | 2017-03-20 16:34:18 +0000 |
|---|---|---|
| committer | drh <drh@noemail.net> | 2017-03-20 16:34:18 +0000 |
| commit | 5f42995a0a51be942cbb9095829767b175da0a87 (patch) | |
| tree | 8b7c45394c69e7d8e738713b35c0387f04cdf0df /src/printf.c | |
| parent | 5b3a3b359a4f31b3776044e864f35557d5dcb2fb (diff) | |
| download | sqlite-5f42995a0a51be942cbb9095829767b175da0a87.tar.gz sqlite-5f42995a0a51be942cbb9095829767b175da0a87.zip | |
Avoid the possibility of signed integer overflow with oversized precisions
in %d conversions in the printf() implementation.
FossilOrigin-Name: ef3a7c877a7549b351aafd983cfa96c863eb2641b6218bdd5cb563f659f879d8
Diffstat (limited to 'src/printf.c')
| -rw-r--r-- | src/printf.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/printf.c b/src/printf.c index 241338b26..a14e65887 100644 --- a/src/printf.c +++ b/src/printf.c @@ -400,12 +400,13 @@ void sqlite3VXPrintf( nOut = etBUFSIZE; zOut = buf; }else{ - nOut = precision + 10 + precision/3; - zOut = zExtra = sqlite3Malloc( nOut ); + u64 n = (u64)precision + 10 + precision/3; + zOut = zExtra = sqlite3Malloc( n ); if( zOut==0 ){ setStrAccumError(pAccum, STRACCUM_NOMEM); return; } + nOut = (int)n; } bufpt = &zOut[nOut-1]; if( xtype==etORDINAL ){ |