From: Eric Blake <eblake@redhat.com>
Date: Fri, 24 Jun 2011 20:04:04 +0000 (-0600)
Subject: buf: protect against integer overflow
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=4a27eb13987e0a935da8404a1ab337c01124bd98;p=people%2Fliuw%2Flibxenctrl-split%2Flibvirt.git

buf: protect against integer overflow

It's unlikely that we'll ever want to escape a string as long as
INT_MAX/6, but adding this check can't hurt.

* src/util/buf.c (virBufferEscapeSexpr, virBufferEscapeString):
Check for (unlikely) overflow.
---

diff --git a/src/util/buf.c b/src/util/buf.c
index 750e2770b..500248683 100644
--- a/src/util/buf.c
+++ b/src/util/buf.c
@@ -311,7 +311,8 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
         return;
     }
 
-    if (VIR_ALLOC_N(escaped, 6 * len + 1) < 0) {
+    if (xalloc_oversized(6, len) ||
+        VIR_ALLOC_N(escaped, 6 * len + 1) < 0) {
         virBufferSetError(buf);
         return;
     }
@@ -398,7 +399,8 @@ virBufferEscapeSexpr(const virBufferPtr buf,
         return;
     }
 
-    if (VIR_ALLOC_N(escaped, 2 * len + 1) < 0) {
+    if (xalloc_oversized(2, len) ||
+        VIR_ALLOC_N(escaped, 2 * len + 1) < 0) {
         virBufferSetError(buf);
         return;
     }