- newlen = (len+addlen)*2;
- newsh = zrealloc(sh, sizeof(struct sdshdr)+newlen+1);
+ newlen = (len+addlen);
+ newfree = ((addlen*2) > USHRT_MAX) ? USHRT_MAX : (addlen*2);
+ if (newlen+newfree >= USHRT_MAX || sh->_len == USHRT_MAX) {
+ if (sh->_len == USHRT_MAX) {
+ newsh = zrealloc(sh, sizeof(struct sdshdr)+newlen+1+newfree);
+ } else {
+ newsh = zmalloc(sizeof(struct sdshdr)+newlen+1+newfree);
+ if (!newsh) return NULL;
+ memcpy(newsh->buf,sh->buf,len);
+ newsh->buf[len] = '\0';
+ zfree(((char*)sh)+sizeof(int));
+ }