xnu-4570.51.1.tar.gz

[apple/xnu.git] / iokit / Kernel / IORangeAllocator.cpp

diff --git a/iokit/Kernel/IORangeAllocator.cpp b/iokit/Kernel/IORangeAllocator.cpp
index 12804d24a13292d5adc89efc65ca6fab54f811ea..393a9c03b1642265954584f7a8067e70413d6aca 100644 (file)
--- a/iokit/Kernel/IORangeAllocator.cpp
+++ b/iokit/Kernel/IORangeAllocator.cpp
@@ -142,7 +142,8 @@ bool IORangeAllocator::allocElement( UInt32 index )
     if( ((numElements == capacity) && capacityIncrement)
      || (!elements)) {
 
     if( ((numElements == capacity) && capacityIncrement)
      || (!elements)) {
 

-       newCapacity = capacity + capacityIncrement;
+       if (os_add_overflow(capacity, capacityIncrement, &newCapacity))
+           return( false );

        newElements = IONew( IORangeAllocatorElement, newCapacity );
        if( !newElements)
            return( false );
        newElements = IONew( IORangeAllocatorElement, newCapacity );
        if( !newElements)
            return( false );