Fixed out-of-bound write in libbf.c

2024-12-12 09:44:33 +08:00 · 2024-09-15 17:59:56 +01:00 · 2024-09-15 17:59:56 +01:00 · f4d9fcfc5b
commit f4d9fcfc5b
parent 6e2e68fd08
1 changed files with 5 additions and 0 deletions
--- a/libbf.c
+++ b/libbf.c
@ -1715,6 +1715,11 @@ static int __bf_div(bf_t *r, const bf_t *a, const bf_t *b, limb_t prec,
        slimb_t d;

        na = n + nb;
+      
+        if (na >= (SIZE_MAX / sizeof(limb_t)) - 1) {
+            return BF_ST_MEM_ERROR;
+        }
+      
        taba = bf_malloc(s, (na + 1) * sizeof(limb_t));
        if (!taba)
            goto fail;