From: Phil Pennock <phil+git@pennock-tech.com>
Date: Fri, 30 Oct 2020 01:30:04 +0000 (-0400)
Subject: SECURITY: a second negative store guard
X-Git-Tag: exim-4.95-RC0~51^2~43
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/410b935d8ed35762b76b0edfa7a9fb9ba6500ebd

SECURITY: a second negative store guard

(cherry picked from commit 706864e934c70941ce7a327f97b7649a1e5f5556)
(cherry picked from commit 9f06dcd6848052f2524658bf871c60a8d48c7dbe)
---

diff --git a/src/src/store.c b/src/src/store.c
index b5115fa13..c664ad9f4 100644
--- a/src/src/store.c
+++ b/src/src/store.c
@@ -428,6 +428,13 @@ int pool = tainted ? store_pool + POOL_TAINT_BASE : store_pool;
 int inc = newsize - oldsize;
 int rounded_oldsize = oldsize;
 
+if (newsize < 0)
+  {
+  log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+            "bad memory extension requested (%d -> %d bytes) at %s %d",
+            oldsize, newsize, func, linenumber);
+  }
+
 /* Check that the block being extended was already of the required taint status;
 refuse to extend if not. */