Potential problem
In array_nextsize (src/libev/ev.c, 2249), the size of the allocated array is calculated using int operands. The expression elem * ncur may exceed the range of int for sufficiently large values of ncur, causing signed integer overflow.
The same multiplication is subsequently performed by ncur *= elem, so changing only the comparison would leave another potentially overflowing operation.
Possible solution
It is suggested to use a separate long variable for calculations involving the array size in bytes. The multiplication can then be performed as (long)elem * ncur, and subsequent rounding calculations can also use this wider type before converting the resulting element count back to int.
This prevents signed integer overflow in the byte-size calculations while preserving ncur as the number of array elements.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burlakov.
Potential problem
In
array_nextsize(src/libev/ev.c, 2249), the size of the allocated array is calculated usingintoperands. The expressionelem * ncurmay exceed the range ofintfor sufficiently large values ofncur, causing signed integer overflow.The same multiplication is subsequently performed by
ncur *= elem, so changing only the comparison would leave another potentially overflowing operation.Possible solution
It is suggested to use a separate
longvariable for calculations involving the array size in bytes. The multiplication can then be performed as(long)elem * ncur, and subsequent rounding calculations can also use this wider type before converting the resulting element count back toint.This prevents signed integer overflow in the byte-size calculations while preserving
ncuras the number of array elements.Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burlakov.