[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Richard Levitte]

The branch OpenSSL_1_0_2-stable has been updated
       via  217534323ec4917c754fb454bf77b6d2ff551e23 (commit)
      from  44cbf6a9fe7db112ae2ed189412ab9e5205028b1 (commit)


- Log -----------------------------------------------------------------
commit 217534323ec4917c754fb454bf77b6d2ff551e23
Author: Richard Levitte <levitte at openssl.org>
Date:   Thu Oct 26 20:49:47 2017 +0200

    Use malloc/memset not calloc for WinCE portability
    
    Fixes: #2539
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/4594)

-----------------------------------------------------------------------

Summary of changes:
 crypto/LPdir_win.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/crypto/LPdir_win.c b/crypto/LPdir_win.c
index 07e63fb..4961254 100644
--- a/crypto/LPdir_win.c
+++ b/crypto/LPdir_win.c
@@ -94,8 +94,23 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
             TCHAR *wdir = NULL;
             /* len_0 denotes string length *with* trailing 0 */
             size_t index = 0, len_0 = strlen(extdir) + 1;
-
-            wdir = (TCHAR *)calloc(len_0, sizeof(TCHAR));
+            size_t amount;
+
+            /*
+             * Size check
+             * The reasoning is that absolutely worst case, each byte in
+             * extdir will take up one TCHAR each, so the maximum size in
+             * bytes that we can tolerate is MAX_PATH TCHARs...  not counting
+             * the ending NUL.
+             */
+            if ((len_0 - 1) > MAX_PATH * sizeof(TCHAR)) {
+                free(*ctx);
+                *ctx = NULL;
+                errno = EINVAL;
+                return 0;
+            }
+            amount = len_0 * sizeof(TCHAR);
+            wdir = (TCHAR *)malloc(amount);
             if (wdir == NULL) {
                 if (extdirbuf != NULL) {
                     free(extdirbuf);