mirror of
https://github.com/torvalds/linux.git
synced 2026-09-21 04:10:02 +02:00
3766856864
[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.
Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.
Fixes:
|
||
|---|---|---|
| .. | ||
| bw_fixed.c | ||
| calcs_logger.h | ||
| conversion.c | ||
| conversion.h | ||
| custom_float.c | ||
| dc_common.c | ||
| dc_common.h | ||
| dce_calcs.c | ||
| fixpt31_32.c | ||
| logger.h | ||
| Makefile | ||
| vector.c | ||