| Summary: | Integer overflow in mm_zalloc | ||
|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Jan Echternach <siw> |
| Component: | Miscellaneous | Assignee: | OpenSSH Bugzilla mailing list <openssh-bugs> |
| Status: | CLOSED FIXED | ||
| Severity: | normal | ||
| Priority: | P2 | ||
| Version: | -current | ||
| Hardware: | All | ||
| OS: | All | ||
thanks, applied Mass change of RESOLVED bugs to CLOSED |
3.5p1 is better than 3.4p1, but still not perfect (on platforms where size_t is larger than u_int). This patch should fix it, although I can't test it: --- openssh-3.5p1/monitor.c-orig Fri Sep 27 05:26:02 2002 +++ openssh-3.5p1/monitor.c Mon Nov 4 18:06:24 2002 @@ -1551,7 +1551,7 @@ void * mm_zalloc(struct mm_master *mm, u_int ncount, u_int size) { - size_t len = size * ncount; + size_t len = (size_t) size * ncount; void *address; if (len == 0 || ncount > SIZE_T_MAX / size)