[PATCH][BZ #15672] Fix error_tail overflow in allocation calculation.

[Joseph S. Myers]

On Mon, 14 Oct 2013, Ondrej Bilka wrote:

> @@ -165,7 +165,7 @@ error_tail (int status, int errnum, const char *message, va_list args)
>  	  if (res != len)
>  	    break;
>  
> -	  if (__builtin_expect (len >= SIZE_MAX / 2, 0))
> +	  if (__builtin_expect (len * sizeof (wchar_t) >= SIZE_MAX / 2, 0))

No, that's incorrect, as len * sizeof (wchar_t) can overflow size_t.  You 
need to compare len directly with SIZE_MAX / 2 / sizeof (wchar_t).

-- 
Joseph S. Myers
joseph@codesourcery.com