c-ares / c-ares / 23414914394

92%

Build Type

push

github

Committed by web-flow

Commit Message

Add overflow checks to ares_buf_ensure_space() (#1094)

Two integer overflow issues in `ares_buf_ensure_space()`
(`src/lib/str/ares_buf.c`):

1. `needed_size++` at line 155 wraps to 0 when `needed_size ==
SIZE_MAX`, causing the subsequent `remaining_size >= needed_size` check
to pass incorrectly.

2. `alloc_size <<= 1` in the doubling loop at line 180 wraps to 0 when
`alloc_size > SIZE_MAX / 2`. Then `remaining_size = 0 - buf->data_len`
wraps to a large unsigned value, the loop exits, and
`ares_realloc(buf->alloc_buf, 0)` frees the buffer. Subsequent writes
via `ares_buf_append` go to freed memory.

Both checks return `ARES_ENOMEM` on overflow, consistent with the
existing allocation failure path at line 185.

Coverage Stats

2 of 4 new or added lines in 1 file covered. (50.0%)

6 existing lines in 3 files now uncovered.

22771 of 24833 relevant lines covered (91.7%)

12891.55 hits per line