diff options
Diffstat (limited to 'stdio-common/vfprintf.c')
| -rw-r--r-- | stdio-common/vfprintf.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c index 8cd7a85b21..f7e5f61cc8 100644 --- a/stdio-common/vfprintf.c +++ b/stdio-common/vfprintf.c @@ -1,4 +1,4 @@ -/* Copyright (C) 1991-2013 Free Software Foundation, Inc. +/* Copyright (C) 1991-2014 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or @@ -1067,7 +1067,13 @@ vfprintf (FILE *s, const CHAR_T *format, va_list ap) /* Allocate dynamically an array which definitely is long \ enough for the wide character version. Each byte in the \ multi-byte string can produce at most one wide character. */ \ - if (__libc_use_alloca (len * sizeof (wchar_t))) \ + if (__glibc_unlikely (len > SIZE_MAX / sizeof (wchar_t))) \ + { \ + __set_errno (EOVERFLOW); \ + done = -1; \ + goto all_done; \ + } \ + else if (__libc_use_alloca (len * sizeof (wchar_t))) \ string = (CHAR_T *) alloca (len * sizeof (wchar_t)); \ else if ((string = (CHAR_T *) malloc (len * sizeof (wchar_t))) \ == NULL) \ |