From 480a03289f1b12007b3d112622375d37bdd8f45f Mon Sep 17 00:00:00 2001 From: miod Date: Tue, 29 Jul 2008 19:13:19 +0000 Subject: [PATCH] Check for multiplication overflow in drm_calloc(). ok oga@ --- sys/dev/pci/drm/drm_memory.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c index 44714ca310b..8d999638b19 100644 --- a/sys/dev/pci/drm/drm_memory.c +++ b/sys/dev/pci/drm/drm_memory.c @@ -57,8 +57,10 @@ drm_alloc(size_t size, int area) void * drm_calloc(size_t nmemb, size_t size, int area) { - /* XXX overflow checking */ - return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO); + if (SIZE_MAX / nmemb < size) + return (NULL); + else + return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO); } void * -- 2.20.1