From 410b935d8ed35762b76b0edfa7a9fb9ba6500ebd Mon Sep 17 00:00:00 2001 From: Phil Pennock Date: Thu, 29 Oct 2020 21:30:04 -0400 Subject: [PATCH] SECURITY: a second negative store guard (cherry picked from commit 706864e934c70941ce7a327f97b7649a1e5f5556) (cherry picked from commit 9f06dcd6848052f2524658bf871c60a8d48c7dbe) --- src/src/store.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/src/store.c b/src/src/store.c index b5115fa13..c664ad9f4 100644 --- a/src/src/store.c +++ b/src/src/store.c @@ -428,6 +428,13 @@ int pool = tainted ? store_pool + POOL_TAINT_BASE : store_pool; int inc = newsize - oldsize; int rounded_oldsize = oldsize; +if (newsize < 0) + { + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "bad memory extension requested (%d -> %d bytes) at %s %d", + oldsize, newsize, func, linenumber); + } + /* Check that the block being extended was already of the required taint status; refuse to extend if not. */ -- 2.30.2