Colin Percival
e981a4e863
Correctly handle the case in calloc(num, size) where
...
(size_t)(num * size) == 0
but both num and size are nonzero.
Reported by: Ilja van Sprundel
Approved by: jasone
Security: Integer overflow; calloc was allocating 1 byte in
response to a request for a multiple of 2^32 (or 2^64)
bytes instead of returning NULL.
2006-08-13 21:54:47 +00:00
..
2006-03-16 14:22:19 +00:00
2006-03-16 14:22:19 +00:00
2006-05-23 02:52:14 +00:00
2006-03-13 01:15:01 +00:00
2006-04-16 16:33:26 +00:00
2006-04-15 15:35:20 +00:00
2006-08-09 18:05:44 +00:00
2006-03-13 01:15:01 +00:00
2006-06-05 14:59:33 +00:00
2006-03-16 14:27:17 +00:00
2006-05-21 11:19:36 +00:00
2006-03-23 16:55:13 +00:00
2006-03-21 15:37:16 +00:00
2006-03-30 09:04:12 +00:00
2006-05-21 11:19:36 +00:00
2006-07-26 08:36:46 +00:00
2006-03-13 01:15:01 +00:00
2006-07-07 14:02:17 +00:00
2006-03-13 01:15:01 +00:00
2006-03-13 01:15:01 +00:00
2006-03-13 01:15:01 +00:00
2006-08-04 12:26:07 +00:00
2006-04-28 12:03:38 +00:00
2006-03-13 01:15:01 +00:00
2006-04-16 14:32:53 +00:00
2006-04-22 16:47:59 +00:00
2006-08-13 21:54:47 +00:00
2006-03-13 01:15:01 +00:00
2006-06-15 15:56:55 +00:00
2006-08-04 07:56:35 +00:00
2006-08-03 03:34:36 +00:00
2006-03-13 01:15:01 +00:00
2006-03-13 01:15:01 +00:00
2006-05-22 05:12:44 +00:00
2006-03-13 00:53:21 +00:00