1212# include "tls.h"
1313#endif
1414
15+ #ifndef SIZE_MAX
16+ # define SIZE_MAX ((size_t) -1)
17+ #endif
18+
1519#ifdef WITH_DMALLOC
1620# include <dmalloc.h>
1721#endif
@@ -576,7 +580,9 @@ static PureFileInfo *sreaddir(char **names_pnt)
576580 return NULL ;
577581 }
578582 files_info_size = CHUNK_SIZE / sizeof * files_info ;
579- if ((files_info = malloc (files_info_size * sizeof * files_info )) == NULL ) {
583+ if (files_info_size == 0U ||
584+ files_info_size > SIZE_MAX / sizeof * files_info ||
585+ (files_info = malloc (files_info_size * sizeof * files_info )) == NULL ) {
580586 closedir (d );
581587 free (names );
582588 return NULL ;
@@ -588,12 +594,20 @@ static PureFileInfo *sreaddir(char **names_pnt)
588594 name_len = strlen (de -> d_name ) + (size_t ) 1U ;
589595 while (names_counter + name_len >= names_size ) {
590596 char * new_names ;
597+ size_t grow ;
591598
592599 if (name_len >= CHUNK_SIZE ) {
593- names_size += name_len + CHUNK_SIZE ;
600+ if (name_len > SIZE_MAX - CHUNK_SIZE ) {
601+ goto nomem ;
602+ }
603+ grow = name_len + CHUNK_SIZE ;
594604 } else {
595- names_size + = CHUNK_SIZE ;
605+ grow = CHUNK_SIZE ;
596606 }
607+ if (names_size > SIZE_MAX - grow ) {
608+ goto nomem ;
609+ }
610+ names_size += grow ;
597611 if ((new_names = realloc (names , names_size )) == NULL ) {
598612 nomem :
599613 closedir (d );
@@ -605,8 +619,13 @@ static PureFileInfo *sreaddir(char **names_pnt)
605619 }
606620 while ((files_info_counter + (size_t ) 1U ) >= files_info_size ) {
607621 PureFileInfo * new_files_info ;
622+ size_t grow = CHUNK_SIZE / sizeof * files_info ;
608623
609- files_info_size += (CHUNK_SIZE / sizeof * files_info );
624+ if (grow == 0U ||
625+ files_info_size > SIZE_MAX / sizeof * files_info - grow ) {
626+ goto nomem ;
627+ }
628+ files_info_size += grow ;
610629 if ((new_files_info = realloc (files_info ,
611630 files_info_size * sizeof * files_info )) == NULL ) {
612631 goto nomem ;
0 commit comments