mirror of
https://github.com/moparisthebest/curl
synced 2024-08-13 17:03:50 -04:00
multi.c: fix possible invalid memory access in case nfds overflows
ufds might not be allocated in case nfds overflows to zero while extra_nfds is still non-zero. udfs is then accessed within the extra_nfds-based for loop.
This commit is contained in:
parent
549b4a659a
commit
ee6791128f
@ -828,7 +828,7 @@ CURLMcode curl_multi_wait(CURLM *multi_handle,
|
|||||||
curlfds = nfds; /* number of internal file descriptors */
|
curlfds = nfds; /* number of internal file descriptors */
|
||||||
nfds += extra_nfds; /* add the externally provided ones */
|
nfds += extra_nfds; /* add the externally provided ones */
|
||||||
|
|
||||||
if(nfds) {
|
if(nfds || extra_nfds) {
|
||||||
ufds = malloc(nfds * sizeof(struct pollfd));
|
ufds = malloc(nfds * sizeof(struct pollfd));
|
||||||
if(!ufds)
|
if(!ufds)
|
||||||
return CURLM_OUT_OF_MEMORY;
|
return CURLM_OUT_OF_MEMORY;
|
||||||
|
Loading…
Reference in New Issue
Block a user