Check that the multiplication to compute the allocation will not
overflow.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
DBG((" %s(%d->%d): new\n", __FUNCTION__, count, n));
+ if (n > (INT_MAX - sizeof(*box)) / sizeof(BoxRec))
+ return false;
+
box = malloc(sizeof(*box) + sizeof(BoxRec)*n);
if (box == NULL)
return false;
DBG((" %s(): new elt\n", __FUNCTION__));
- if (! _sna_damage_create_boxes(damage, count))
+ if (!_sna_damage_create_boxes(damage, count))
return damage;
for (i = 0; i < count; i++) {