1.1 --- a/src/mempool.c Tue Jan 02 17:00:21 2018 +0100 1.2 +++ b/src/mempool.c Sun Jan 21 10:13:21 2018 +0100 1.3 @@ -65,12 +65,17 @@ 1.4 } 1.5 1.6 UcxMempool *ucx_mempool_new(size_t n) { 1.7 + size_t poolsz; 1.8 + if(ucx_szmul(n, sizeof(void*), &poolsz)) { 1.9 + return NULL; 1.10 + } 1.11 + 1.12 UcxMempool *pool = (UcxMempool*)malloc(sizeof(UcxMempool)); 1.13 if (!pool) { 1.14 return NULL; 1.15 } 1.16 1.17 - pool->data = (void**) malloc(n * sizeof(void*)); 1.18 + pool->data = (void**) malloc(poolsz); 1.19 if (pool->data == NULL) { 1.20 free(pool); 1.21 return NULL; 1.22 @@ -100,7 +105,12 @@ 1.23 return 1; 1.24 } 1.25 1.26 - void **data = (void**) realloc(pool->data, newcap*sizeof(void*)); 1.27 + size_t newcapsz; 1.28 + if(ucx_szmul(newcap, sizeof(void*), &newcapsz)) { 1.29 + return 1; 1.30 + } 1.31 + 1.32 + void **data = (void**) realloc(pool->data, newcapsz); 1.33 if (data) { 1.34 pool->data = data; 1.35 pool->size = newcap; 1.36 @@ -111,6 +121,10 @@ 1.37 } 1.38 1.39 void *ucx_mempool_malloc(UcxMempool *pool, size_t n) { 1.40 + if(((size_t)-1) - sizeof(ucx_destructor) < n) { 1.41 + return NULL; 1.42 + } 1.43 + 1.44 if (pool->ndata >= pool->size) { 1.45 size_t newcap = pool->size*2; 1.46 if (newcap < pool->size || ucx_mempool_chcap(pool, newcap)) { 1.47 @@ -132,7 +146,12 @@ 1.48 } 1.49 1.50 void *ucx_mempool_calloc(UcxMempool *pool, size_t nelem, size_t elsize) { 1.51 - void *ptr = ucx_mempool_malloc(pool, nelem*elsize); 1.52 + size_t msz; 1.53 + if(ucx_szmul(nelem, elsize, &msz)) { 1.54 + return NULL; 1.55 + } 1.56 + 1.57 + void *ptr = ucx_mempool_malloc(pool, msz); 1.58 if (!ptr) { 1.59 return NULL; 1.60 } 1.61 @@ -141,6 +160,10 @@ 1.62 } 1.63 1.64 void *ucx_mempool_realloc(UcxMempool *pool, void *ptr, size_t n) { 1.65 + if(((size_t)-1) - sizeof(ucx_destructor) < n) { 1.66 + return NULL; 1.67 + } 1.68 + 1.69 char *mem = ((char*)ptr) - sizeof(ucx_destructor); 1.70 char *newm = (char*) realloc(mem, n + sizeof(ucx_destructor)); 1.71 if (!newm) {