| commit | 785086cfbaf15a78a921f5589a76517b1d4840b1 | |
| author | Nick Mathewson <nickm@torproject.org> | |
| Mon, 13 Dec 2010 23:40:21 +0000 (13 18:40 -0500) | ||
| committer | Nick Mathewson <nickm@torproject.org> | |
| Mon, 13 Dec 2010 23:40:21 +0000 (13 18:40 -0500) | ||
| tree | 452b47f3da27025aea6193ba045a6e97a0851a65 | treesnapshot (tar.gz zip) |
| parent | 649ee99846966c87350cd3282639326f8b4ee4af | commitdiff |
Have all of our allocation functions and a few others check for underflow
It's all too easy in C to convert an unsigned value to a signed one,
which will (on all modern computers) give you a huge signed value. If
you have a size_t value of size greater than SSIZE_T_MAX, that is way
likelier to be an underflow than it is to be an actual request for
more than 2gb of memory in one go. (There's nothing in Tor that
should be trying to allocate >2gb chunks.)
It's all too easy in C to convert an unsigned value to a signed one,
which will (on all modern computers) give you a huge signed value. If
you have a size_t value of size greater than SSIZE_T_MAX, that is way
likelier to be an underflow than it is to be an actual request for
more than 2gb of memory in one go. (There's nothing in Tor that
should be trying to allocate >2gb chunks.)