malloc: do the overflow maths in unsigned
authorAlan Cox <alan@linux.intel.com>
Tue, 28 Jun 2016 09:46:15 +0000 (10:46 +0100)
committerAlan Cox <alan@linux.intel.com>
Tue, 28 Jun 2016 09:46:15 +0000 (10:46 +0100)
Library/libs/malloc.c

index abe00a4..2e567fb 100644 (file)
@@ -33,7 +33,7 @@ static struct memh *brkmore(size_t nb)
        if (p == (struct memh *) -1)
                return NULL;
        /* Overflow catch */
-       if (p + nb < p)
+       if ((uintptr_t)p + sizeof(struct memh) * nb < (uintptr_t)p)
                return NULL;
        /* Move our break point. Using brk this way avoids the sign problems */
        if (brk(p + nb))