From 13598092f789f9d2b2396a5c0d38ad01b94f8616 Mon Sep 17 00:00:00 2001 From: Mohammed Abdullah Date: Wed, 25 Feb 2026 10:49:12 +0000 Subject: [PATCH] Fix potential integer overflow in buffer growth logic Add SIZE_MAX guard before doubling buffer sizes in yaml_string_extend, yaml_stack_extend, and yaml_queue_extend. Prevents overflow during realloc size calculation. --- src/api.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/api.c b/src/api.c index 16f88bd..3113354 100644 --- a/src/api.c +++ b/src/api.c @@ -1,5 +1,6 @@ #include "yaml_private.h" +#include /* * Get the library version. @@ -74,14 +75,14 @@ YAML_DECLARE(int) yaml_string_extend(yaml_char_t **start, yaml_char_t **pointer, yaml_char_t **end) { - yaml_char_t *new_start = (yaml_char_t *)yaml_realloc((void*)*start, (*end - *start)*2); + yaml_char_t *new_start = (yaml_char_t *)yaml_realloc((void*)*start, (((*end - *start) > SIZE_MAX/2) ? 0 : (*end - *start)*2)); if (!new_start) return 0; memset(new_start + (*end - *start), 0, *end - *start); *pointer = new_start + (*pointer - *start); - *end = new_start + (*end - *start)*2; + *end = new_start + (((*end - *start) > SIZE_MAX/2) ? 0 : (*end - *start)*2); *start = new_start; return 1; @@ -123,12 +124,12 @@ yaml_stack_extend(void **start, void **top, void **end) if ((char *)*end - (char *)*start >= INT_MAX / 2) return 0; - new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); + new_start = yaml_realloc(*start, ((((char *)*end - (char *)*start) > SIZE_MAX/2) ? 0 : ((char *)*end - (char *)*start)*2)); if (!new_start) return 0; *top = (char *)new_start + ((char *)*top - (char *)*start); - *end = (char *)new_start + ((char *)*end - (char *)*start)*2; + *end = (char *)new_start + ((((char *)*end - (char *)*start) > SIZE_MAX/2) ? 0 : ((char *)*end - (char *)*start)*2); *start = new_start; return 1; @@ -145,13 +146,13 @@ yaml_queue_extend(void **start, void **head, void **tail, void **end) if (*start == *head && *tail == *end) { void *new_start = yaml_realloc(*start, - ((char *)*end - (char *)*start)*2); + ((((char *)*end - (char *)*start) > SIZE_MAX/2) ? 0 : ((char *)*end - (char *)*start)*2)); if (!new_start) return 0; *head = (char *)new_start + ((char *)*head - (char *)*start); *tail = (char *)new_start + ((char *)*tail - (char *)*start); - *end = (char *)new_start + ((char *)*end - (char *)*start)*2; + *end = (char *)new_start + ((((char *)*end - (char *)*start) > SIZE_MAX/2) ? 0 : ((char *)*end - (char *)*start)*2); *start = new_start; }