From: Richard Levitte <levitte@openssl.org>
Date: Thu, 26 Oct 2017 18:49:47 +0000 (+0200)
Subject: Use malloc/memset not calloc for WinCE portability
X-Git-Tag: OpenSSL_1_0_2m~7
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=217534323ec4917c754fb454bf77b6d2ff551e23;p=oweals%2Fopenssl.git

Use malloc/memset not calloc for WinCE portability

Fixes: #2539

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4594)
---

diff --git a/crypto/LPdir_win.c b/crypto/LPdir_win.c
index 07e63fb424..4961254d9a 100644
--- a/crypto/LPdir_win.c
+++ b/crypto/LPdir_win.c
@@ -94,8 +94,23 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
             TCHAR *wdir = NULL;
             /* len_0 denotes string length *with* trailing 0 */
             size_t index = 0, len_0 = strlen(extdir) + 1;
-
-            wdir = (TCHAR *)calloc(len_0, sizeof(TCHAR));
+            size_t amount;
+
+            /*
+             * Size check
+             * The reasoning is that absolutely worst case, each byte in
+             * extdir will take up one TCHAR each, so the maximum size in
+             * bytes that we can tolerate is MAX_PATH TCHARs...  not counting
+             * the ending NUL.
+             */
+            if ((len_0 - 1) > MAX_PATH * sizeof(TCHAR)) {
+                free(*ctx);
+                *ctx = NULL;
+                errno = EINVAL;
+                return 0;
+            }
+            amount = len_0 * sizeof(TCHAR);
+            wdir = (TCHAR *)malloc(amount);
             if (wdir == NULL) {
                 if (extdirbuf != NULL) {
                     free(extdirbuf);