Check for integer overflows in formatting functions

[glibc.git] / stdio-common / printf_fp.c

diff --git a/stdio-common/printf_fp.c b/stdio-common/printf_fp.c
index cd3ada64416334ad2eb6dedfcad9bbadefd43c44..b60ddecef080ab6ab8c6bbe635500207545a13e5 100644 (file)
--- a/stdio-common/printf_fp.c
+++ b/stdio-common/printf_fp.c
@@ -891,8 +891,15 @@ ___printf_fp (FILE *fp,
        it is possible that we need two more characters in front of all the
        other output.  If the amount of memory we have to allocate is too
        large use `malloc' instead of `alloca'.  */
-    size_t wbuffer_to_alloc = (2 + (size_t) chars_needed) * sizeof (wchar_t);
-    buffer_malloced = ! __libc_use_alloca (chars_needed * 2 * sizeof (wchar_t));
+    if (__builtin_expect (chars_needed >= (size_t) -1 / sizeof (wchar_t) - 2
+                         || chars_needed < fracdig_max, 0))
+      {
+       /* Some overflow occurred.  */
+       __set_errno (ERANGE);
+       return -1;
+      }
+    size_t wbuffer_to_alloc = (2 + chars_needed) * sizeof (wchar_t);
+    buffer_malloced = ! __libc_use_alloca (wbuffer_to_alloc);
     if (__builtin_expect (buffer_malloced, 0))
       {
        wbuffer = (wchar_t *) malloc (wbuffer_to_alloc);