From 31b3a2b31a50f83ed100e01485013fd871399f45 Mon Sep 17 00:00:00 2001 From: Tom Sepez Date: Mon, 18 May 2015 14:18:08 -0700 Subject: Add safe FX_Alloc2D() macro This avoids unchecked multiplications when computing a size argument to malloc(). Such an overflow is very scary, and can result in exploitable bugs. Along the way, kill off some return checks, since we know this can't return NULL. R=thestig@chromium.org Review URL: https://codereview.chromium.org/1143663004 --- core/src/fxcrt/fx_basic_memmgr_unittest.cpp | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'core/src/fxcrt/fx_basic_memmgr_unittest.cpp') diff --git a/core/src/fxcrt/fx_basic_memmgr_unittest.cpp b/core/src/fxcrt/fx_basic_memmgr_unittest.cpp index 565021d29e..c70f3b197d 100644 --- a/core/src/fxcrt/fx_basic_memmgr_unittest.cpp +++ b/core/src/fxcrt/fx_basic_memmgr_unittest.cpp @@ -12,6 +12,8 @@ namespace { const size_t kMaxByteAlloc = std::numeric_limits::max(); const size_t kMaxIntAlloc = kMaxByteAlloc / sizeof(int); const size_t kOverflowIntAlloc = kMaxIntAlloc + 100; +const size_t kWidth = 640; +const size_t kOverflowIntAlloc2D = kMaxIntAlloc / kWidth + 10; } // namespace @@ -35,6 +37,11 @@ TEST(fxcrt, FX_AllocOverflow) { FX_Free(ptr); } +TEST(fxcrt, FX_AllocOverflow2D) { + EXPECT_DEATH_IF_SUPPORTED( + FX_Alloc2D(int, kWidth, kOverflowIntAlloc2D), ""); +} + TEST(fxcrt, DISABLED_FX_TryAllocOOM) { EXPECT_FALSE(FX_TryAlloc(int, kMaxIntAlloc)); -- cgit v1.2.3