diff options
| author | tpearson <tpearson@283d02a7-25f6-0310-bc7c-ecb5cbfe19da> | 2010-09-29 05:15:51 +0000 |
|---|---|---|
| committer | tpearson <tpearson@283d02a7-25f6-0310-bc7c-ecb5cbfe19da> | 2010-09-29 05:15:51 +0000 |
| commit | 33e60e8e78543462d31e8c6a7c3577ffe18b6647 (patch) | |
| tree | f655bb5f0a2e19a2396aeea199df3d9caf60c119 /kjs | |
| parent | c9b50480aa0c5ccbf1a4a4005fd735be3a3e0841 (diff) | |
| download | tdelibs-33e60e8e78543462d31e8c6a7c3577ffe18b6647.tar.gz tdelibs-33e60e8e78543462d31e8c6a7c3577ffe18b6647.zip | |
Critical security patches for the following vulnerabilities:
CVE-2009-0689
CVE-2009-1687
CVE-2009-1690
CVE-2009-1698
CVE-2009-2702
git-svn-id: svn://anonsvn.kde.org/home/kde/branches/trinity/kdelibs@1180823 283d02a7-25f6-0310-bc7c-ecb5cbfe19da
Diffstat (limited to 'kjs')
| -rw-r--r-- | kjs/collector.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kjs/collector.cpp b/kjs/collector.cpp index 62d594329..b8d233850 100644 --- a/kjs/collector.cpp +++ b/kjs/collector.cpp @@ -23,6 +23,7 @@ #include "value.h" #include "internal.h" +#include <limits.h> #ifndef MAX #define MAX(a,b) ((a) > (b) ? (a) : (b)) @@ -119,6 +120,9 @@ void* Collector::allocate(size_t s) // didn't find one, need to allocate a new block if (heap.usedBlocks == heap.numBlocks) { + static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR; + if (heap.numBlocks > maxNumBlocks) + return 0L; heap.numBlocks = MAX(MIN_ARRAY_SIZE, heap.numBlocks * GROWTH_FACTOR); heap.blocks = (CollectorBlock **)realloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock *)); } |