Mirrors_Framework/SDL
1
0
Fork 0
mirror of https://github.com/libsdl-org/SDL.git synced 2026-05-27 10:57:22 +08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix possible integer overflow of size + 1

Browse Source
This commit is contained in:
nightmareci
2025-01-23 15:47:55 -08:00
committed by Sam Lantinga
parent 129ebc77b9
commit 2e381a717f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/io/SDL_iostream.c
+2 -2
View File
@@ -1153,7 +1153,7 @@ void *SDL_LoadFile_IO(SDL_IOStream *src, size_t *datasize, bool closeio)
size = FILE_CHUNK_SIZE; size = FILE_CHUNK_SIZE;
loading_chunks = true; loading_chunks = true;
} }
if (size >= SDL_SIZE_MAX) { if (size >= SDL_SIZE_MAX - 1) {
goto done; goto done;
} }
data = (char *)SDL_malloc((size_t)(size + 1)); data = (char *)SDL_malloc((size_t)(size + 1));
@@ -1166,7 +1166,7 @@ void *SDL_LoadFile_IO(SDL_IOStream *src, size_t *datasize, bool closeio)
if (loading_chunks) { if (loading_chunks) {
if ((size_total + FILE_CHUNK_SIZE) > size) { if ((size_total + FILE_CHUNK_SIZE) > size) {
size = (size_total + FILE_CHUNK_SIZE); size = (size_total + FILE_CHUNK_SIZE);
if (size >= SDL_SIZE_MAX) { if (size >= SDL_SIZE_MAX - 1) {
newdata = NULL; newdata = NULL;
} else { } else {
newdata = (char *)SDL_realloc(data, (size_t)(size + 1)); newdata = (char *)SDL_realloc(data, (size_t)(size + 1));