bool OSArray::initWithCapacity(unsigned int inCapacity)
{
- int size;
+ unsigned int size;
if (!super::init())
return false;
+ // integer overflow check
+ if (inCapacity > (UINT_MAX / sizeof(const OSMetaClassBase*)))
+ return false;
+
size = sizeof(const OSMetaClassBase *) * inCapacity;
array = (const OSMetaClassBase **) kalloc(size);
if (!array)
unsigned int OSArray::ensureCapacity(unsigned int newCapacity)
{
const OSMetaClassBase **newArray;
- int oldSize, newSize;
+ unsigned int finalCapacity;
+ unsigned int oldSize, newSize;
if (newCapacity <= capacity)
return capacity;
// round up
- newCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
+ finalCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
* capacityIncrement;
- newSize = sizeof(const OSMetaClassBase *) * newCapacity;
+
+ // integer overflow check
+ if ((finalCapacity < newCapacity) || (finalCapacity > (UINT_MAX / sizeof(const OSMetaClassBase*))))
+ return capacity;
+
+ newSize = sizeof(const OSMetaClassBase *) * finalCapacity;
newArray = (const OSMetaClassBase **) kalloc(newSize);
if (newArray) {
bzero(&newArray[capacity], newSize - oldSize);
kfree(array, oldSize);
array = newArray;
- capacity = newCapacity;
+ capacity = finalCapacity;
}
return capacity;
if (!s->addXMLStartTag(this, "array")) return false;
- for (unsigned i = 0; i < count; i++) {
- if (!array[i]->serialize(s)) return false;
+ for (unsigned i = 0; i < count; i++) {
+ if (array[i] == NULL || !array[i]->serialize(s)) return false;
}
return s->addXMLEndTag("array");