diff --git a/libbf.c b/libbf.c index 05d62ed..b40f28c 100644 --- a/libbf.c +++ b/libbf.c @@ -1715,6 +1715,11 @@ static int __bf_div(bf_t *r, const bf_t *a, const bf_t *b, limb_t prec, slimb_t d; na = n + nb; + + if (na >= (SIZE_MAX / sizeof(limb_t)) - 1) { + return BF_ST_MEM_ERROR; + } + taba = bf_malloc(s, (na + 1) * sizeof(limb_t)); if (!taba) goto fail;