[klibc] calloc: Fail if multiplication overflows
authorBen Hutchings <ben@decadent.org.uk>
Wed, 28 Apr 2021 02:29:50 +0000 (04:29 +0200)
committerBen Hutchings <benh@debian.org>
Fri, 30 Apr 2021 01:05:23 +0000 (02:05 +0100)
commit709e9f426e18e5ac35d630f331107a6d461a689a
tree5130aeb21a2bcbcce04888ae4a358a3df6aebbde
parent3c744358e92b3475e351e6d9b3b7c6882de9f18c
[klibc] calloc: Fail if multiplication overflows

Origin: https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=292650f04c2b5348b4efbad61fb014ed09b4f3f2
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-31870

calloc() multiplies its 2 arguments together and passes the result to
malloc().  Since the factors and product both have type size_t, this
can result in an integer overflow and subsequent buffer overflow.
Check for this and fail if it happens.

CVE-2021-31870

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0037-klibc-calloc-Fail-if-multiplication-overflows.patch
usr/klibc/calloc.c