From: miod <miod@openbsd.org>
Date: Tue, 29 Jul 2008 19:13:19 +0000 (+0000)
Subject: Check for multiplication overflow in drm_calloc(). ok oga@
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=480a03289f1b12007b3d112622375d37bdd8f45f;p=openbsd

Check for multiplication overflow in drm_calloc(). ok oga@
---

diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index 44714ca310b..8d999638b19 100644
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -57,8 +57,10 @@ drm_alloc(size_t size, int area)
 void *
 drm_calloc(size_t nmemb, size_t size, int area)
 {
-	/* XXX overflow checking */
-	return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
+	if (SIZE_MAX / nmemb < size)
+		return (NULL);
+	else
+		return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
 }
 
 void *