✅ check for integer overflow before allocation

linkdd · Jul 5, 2024 · 16f5049 · 16f5049
1 parent de49d80
commit 16f5049
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/include/larena.h b/include/larena.h
@@ -81,7 +81,11 @@ void *lobject_deref(const lobject *self);
 #include <string.h>
 
 static inline size_t align_size_forward(size_t size, size_t alignment) {
-  return (size + alignment - 1) & ~(alignment - 1);
+  if (alignment == 0) return size;
+  size_t remainder = size % alignment;
+  if (remainder == 0) return size;
+  if (size > SIZE_MAX - (alignment - remainder)) return 0;
+  return size + alignment - remainder;
 }
 
 static void *stdlib_alloc(size_t size, void *ctx) {
@@ -127,13 +131,18 @@ bool larena_alloc(larena *self, size_t size, lobject *obj) {
   assert(size > 0);
 
   size = align_size_forward(size, alignof(max_align_t));
+  if ((size == 0) || (self->offset > SIZE_MAX - size)) return false;
 
   if (self->offset + size > self->capacity) {
     size_t allocsz = align_size_forward(
       (self->offset + size) - self->capacity,
       LARENA_ALIGNMENT
     );
 
+    if (allocsz == 0) {
+      return false;
+    }
+
     void *newdata = self->allocator->realloc(
       self->data,
       self->capacity,