Security-55471.14.4.tar.gz

[apple/security.git] / libsecurity_utilities / lib / blob.cpp

diff --git a/libsecurity_utilities/lib/blob.cpp b/libsecurity_utilities/lib/blob.cpp
index b0dab75f80963ade253612f35e3639ec0a686761..04be864e83793ecea3273a4b3d4eeda3202dab8a 100644 (file)
--- a/libsecurity_utilities/lib/blob.cpp
+++ b/libsecurity_utilities/lib/blob.cpp
@@ -114,15 +114,19 @@ BlobCore *BlobCore::readBlob(std::FILE *file, uint32_t magic, size_t minSize, si
 BlobWrapper *BlobWrapper::alloc(size_t length, Magic magic /* = _magic */)
 {
        size_t wrapLength = length + sizeof(BlobCore);
 BlobWrapper *BlobWrapper::alloc(size_t length, Magic magic /* = _magic */)
 {
        size_t wrapLength = length + sizeof(BlobCore);

+       if (wrapLength < length)        // overflow
+               return NULL;

        BlobWrapper *w = (BlobWrapper *)malloc(wrapLength);
        BlobWrapper *w = (BlobWrapper *)malloc(wrapLength);

-       w->BlobCore::initialize(magic, wrapLength);
+       if (w)
+               w->BlobCore::initialize(magic, wrapLength);

        return w;
 }
 
 BlobWrapper *BlobWrapper::alloc(const void *data, size_t length, Magic magic /* = _magic */)
 {
        BlobWrapper *w = alloc(length, magic);
        return w;
 }
 
 BlobWrapper *BlobWrapper::alloc(const void *data, size_t length, Magic magic /* = _magic */)
 {
        BlobWrapper *w = alloc(length, magic);

-       memcpy(w->data(), data, w->length());
+       if (w)
+               memcpy(w->data(), data, w->length());

        return w;
 }
 
        return w;
 }