Add check preventing integer multiplication wrapping around in scratch_max_allocation

2019-07-12 09:56:56 +00:00
parent fa33017135
commit 4edaf06fb0
2 changed files with 12 additions and 0 deletions
--- a/src/scratch_impl.h
+++ b/src/scratch_impl.h
@@ -60,6 +60,10 @@ static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_c
        secp256k1_callback_call(error_callback, "invalid scratch space");
        return 0;
    }
+    /* Ensure that multiplication will not wrap around */
+    if (ALIGNMENT > 1 && objects > SIZE_MAX/(ALIGNMENT - 1)) {
+        return 0;
+    }
    if (scratch->max_size - scratch->alloc_size <= objects * (ALIGNMENT - 1)) {
        return 0;
    }