Colin Percival
e981a4e863
Correctly handle the case in calloc(num, size) where
...
(size_t)(num * size) == 0
but both num and size are nonzero.
Reported by: Ilja van Sprundel
Approved by: jasone
Security: Integer overflow; calloc was allocating 1 byte in
response to a request for a multiple of 2^32 (or 2^64)
bytes instead of returning NULL.
2006-08-13 21:54:47 +00:00
..
2006-02-26 23:01:11 +00:00
2006-05-19 19:06:38 +00:00
2005-09-12 13:46:32 +00:00
2003-12-19 17:11:20 +00:00
2003-12-19 17:11:21 +00:00
2004-02-10 20:42:33 +00:00
2004-07-04 20:55:50 +00:00
2005-09-12 13:46:32 +00:00
2005-01-20 09:17:07 +00:00
2005-01-20 09:17:07 +00:00
2004-07-06 13:58:45 +00:00
2004-07-31 01:00:50 +00:00
2004-03-06 17:05:45 +00:00
2004-02-23 03:32:10 +00:00
2004-02-23 03:30:02 +00:00
2003-09-14 13:41:59 +00:00
2006-02-13 00:04:04 +00:00
2005-01-20 09:17:07 +00:00
2005-12-24 22:37:59 +00:00
2005-01-20 09:17:07 +00:00
2006-03-28 22:16:04 +00:00
2006-04-13 18:19:44 +00:00
2006-08-13 21:54:47 +00:00
2005-01-12 03:39:34 +00:00
2006-01-12 07:28:21 +00:00
2005-01-20 09:17:07 +00:00
2004-07-02 23:52:20 +00:00
2003-11-11 04:59:23 +00:00
2004-11-10 17:25:49 +00:00
2005-01-20 09:17:07 +00:00
2004-01-20 03:02:18 +00:00
2005-09-12 19:52:42 +00:00
2005-01-20 09:17:07 +00:00
2005-01-21 13:31:02 +00:00
2006-05-20 21:11:35 +00:00
2005-01-21 13:31:02 +00:00
2005-01-21 13:31:02 +00:00
2006-03-15 14:45:45 +00:00
2006-03-14 19:53:03 +00:00
2006-05-20 21:11:35 +00:00
2005-01-21 13:31:02 +00:00
2005-01-21 13:31:02 +00:00
2005-01-21 13:31:02 +00:00
2006-03-28 22:16:04 +00:00
2006-06-23 13:36:33 +00:00