Security-57337.60.2.tar.gz

[apple/security.git] / libsecurity_smime / lib / cmsarray.c

diff --git a/libsecurity_smime/lib/cmsarray.c b/libsecurity_smime/lib/cmsarray.c
index cc1b71a68cab0bc2c8c9c0392affcad2bdae565b..af37804e3b164c7fa6aa841ca6ff8532ea33caf7 100644 (file)
--- a/libsecurity_smime/lib/cmsarray.c
+++ b/libsecurity_smime/lib/cmsarray.c
@@ -59,6 +59,7 @@
 void **
 SecCmsArrayAlloc(PRArenaPool *poolp, int n)
 {
 void **
 SecCmsArrayAlloc(PRArenaPool *poolp, int n)
 {

+    if (n>=(int)(INT_MAX/sizeof(void *))) {return (void **)NULL;} // Prevent under-allocation due to integer overflow

     return (void **)PORT_ArenaZAlloc(poolp, n * sizeof(void *));
 }
 
     return (void **)PORT_ArenaZAlloc(poolp, n * sizeof(void *));
 }
 


@@ -85,6 +86,10 @@ SecCmsArrayAdd(PRArenaPool *poolp, void ***array, void *obj)
        n = 0; p = *array;
        while (*p++)
            n++;
        n = 0; p = *array;
        while (*p++)
            n++;

+       if (n>=(int)((INT_MAX/sizeof(void *))-2)) {
+               // Prevent under-allocation due to integer overflow
+               return SECFailure;
+       }

        dest = (void **)PORT_ArenaGrow (poolp, 
                              *array,
                              (n + 1) * sizeof(void *),
        dest = (void **)PORT_ArenaGrow (poolp, 
                              *array,
                              (n + 1) * sizeof(void *),


@@ -143,12 +148,19 @@ SecCmsArraySort(void **primary, int (*compare)(void *,void *), void **secondary,
 {
     int n, i, limit, lastxchg;
     void *tmp;
 {
     int n, i, limit, lastxchg;
     void *tmp;

-
+    int n_2nd=0,n_3rd=0;

     n = SecCmsArrayCount(primary);
 
     PORT_Assert(secondary == NULL || SecCmsArrayCount(secondary) == n);
     PORT_Assert(tertiary == NULL || SecCmsArrayCount(tertiary) == n);
     n = SecCmsArrayCount(primary);
 
     PORT_Assert(secondary == NULL || SecCmsArrayCount(secondary) == n);
     PORT_Assert(tertiary == NULL || SecCmsArrayCount(tertiary) == n);

-    
+
+    if (secondary) {
+        n_2nd = SecCmsArrayCount(secondary);
+    }
+    if (tertiary) {
+        n_3rd = SecCmsArrayCount(tertiary);
+    }
+

     if (n <= 1)        /* ordering is fine */
        return;
     
     if (n <= 1)        /* ordering is fine */
        return;
     


@@ -162,12 +174,12 @@ SecCmsArraySort(void **primary, int (*compare)(void *,void *), void **secondary,
                tmp = primary[i+1];
                primary[i+1] = primary[i];
                primary[i] = tmp;
                tmp = primary[i+1];
                primary[i+1] = primary[i];
                primary[i] = tmp;

-               if (secondary) {                /* secondary array? */
-                   tmp = secondary[i+1];       /* exchange there as well */
+               if (secondary && ((i+1)<n_2nd)) {/* secondary array? */
+                   tmp = secondary[i+1];        /* exchange there as well */

                    secondary[i+1] = secondary[i];
                    secondary[i] = tmp;
                }
                    secondary[i+1] = secondary[i];
                    secondary[i] = tmp;
                }

-               if (tertiary) {                 /* tertiary array? */
+               if (tertiary && ((i+1)<n_3rd)) {/* tertiary array? */

                    tmp = tertiary[i+1];        /* exchange there as well */
                    tertiary[i+1] = tertiary[i];
                    tertiary[i] = tmp;
                    tmp = tertiary[i+1];        /* exchange there as well */
                    tertiary[i+1] = tertiary[i];
                    tertiary[i] = tmp;