Guard allocation-size calculation in ctest_sprintf#330
Guard allocation-size calculation in ctest_sprintf#330orbisai0security wants to merge 2 commits into
Conversation
Automated security fix generated by Orbis Security AI
| { | ||
| result = malloc(neededSize + 1); | ||
| result = malloc((size_t)neededSize + 1); | ||
| if (result == NULL) |
There was a problem hiding this comment.
PR description claims that the malloc on line 623 is not checked for NULL, the check is here on line 624.
There was a problem hiding this comment.
You're right — the PR description was wrong. The existing code does check malloc for NULL immediately after allocation.
I've reframed this as a narrower defensive integer-overflow fix: guarding the neededSize + 1 allocation-size calculation before the addition is evaluated. I'll update the PR title/description and patch accordingly. If you think this edge case is too theoretical for this project, I'm also happy to close it.
There was a problem hiding this comment.
You’re right, the PR description was wrong. The existing code does check malloc for NULL immediately after allocation.
I’ve reframed this as a narrower defensive integer-overflow fix: guarding the neededSize + 1 allocation-size calculation before the addition is evaluated. I’ve updated the PR title/description and patched accordingly.
… ctest_vsprintf_char neededSize + 1 is evaluated as signed int arithmetic before promotion to size_t. Add explicit INT_MAX guard (CWE-190) and move limits.h unconditional so INT_MAX is available on all platforms. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
orbisai0security
changed the title
2 participants
This PR fixes a narrowly scoped defensive integer-overflow edge case in ctest.c.
The existing code already checks the result of malloc, so this is not a missing NULL-check fix. However, neededSize is an int returned from vsnprintf, and the expression neededSize + 1 is evaluated as signed integer arithmetic before being passed to malloc. If neededSize were INT_MAX, the addition could overflow before conversion to size_t.
This patch adds an explicit guard before the allocation-size calculation and keeps the existing malloc NULL check.
Vulnerability
src/ctest.cChanges
src/ctest.c: move#include <limits.h>unconditional; addINT_MAXguard before allocation-size arithmetic