core: fix integer overflow in calls to realloc (issue #809)

1 files changed, 5 insertions, 0 deletions

diff --git a/src/core/wee-util.c b/src/core/wee-util.c
index b1f567916..0dccb1861 100644
--- a/src/core/wee-util.c
+++ b/src/core/wee-util.c
@@ -24,6 +24,7 @@
 #endif
 
 #include <stdlib.h>
+#include <stdint.h>
 #include <errno.h>
 #include <string.h>
 #include <sys/types.h>
@@ -672,6 +673,8 @@ util_file_get_content (const char *filename)
 
     while (!feof (f))
     {
+        if (fp > SIZE_MAX - (1024 * sizeof (char)))
+            goto error;
         buffer2 = (char *) realloc (buffer, (fp + (1024 * sizeof (char))));
         if (!buffer2)
             goto error;
@@ -681,6 +684,8 @@ util_file_get_content (const char *filename)
             goto error;
         fp += count;
     }
+    if (fp > SIZE_MAX - sizeof (char))
+        goto error;
     buffer2 = (char *) realloc (buffer, fp + sizeof (char));
     if (!buffer2)
         goto error;