diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/malloc.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/src/malloc.c b/src/malloc.c index d9c036da6..468e057a8 100644 --- a/src/malloc.c +++ b/src/malloc.c @@ -12,7 +12,7 @@ ** ** Memory allocation functions used throughout sqlite. ** -** $Id: malloc.c,v 1.55 2009/02/17 16:29:11 danielk1977 Exp $ +** $Id: malloc.c,v 1.56 2009/02/17 18:37:29 drh Exp $ */ #include "sqliteInt.h" #include <stdarg.h> @@ -266,7 +266,15 @@ static int mallocWithAlarm(int n, void **pp){ */ void *sqlite3Malloc(int n){ void *p; - if( n<=0 ){ + if( n<=0 || NEVER(n>=0x7fffff00) ){ + /* The NEVER(n>=0x7fffff00) term is added out of paranoia. We want to make + ** absolutely sure that there is nothing within SQLite that can cause a + ** memory allocation of a number of bytes which is near the maximum signed + ** integer value and thus cause an integer overflow inside of the xMalloc() + ** implementation. The n>=0x7fffff00 gives us 255 bytes of headroom. The + ** test should never be true because SQLITE_MAX_LENGTH should be much + ** less than 0x7fffff00 and it should catch large memory allocations + ** before they reach this point. */ p = 0; }else if( sqlite3GlobalConfig.bMemstat ){ sqlite3_mutex_enter(mem0.mutex); @@ -555,7 +563,8 @@ void *sqlite3Realloc(void *pOld, int nBytes){ if( pOld==0 ){ return sqlite3Malloc(nBytes); } - if( nBytes<=0 ){ + if( nBytes<=0 || NEVER(nBytes>=0x7fffff00) ){ + /* The NEVER(...) term is explained in comments on sqlite3Malloc() */ sqlite3_free(pOld); return 0; } |