Make sure the memory allocation routines check for negative sizes

diff --git a/crypto/mem.c b/crypto/mem.c
index d7d3cda5dcd25b605e89180c5e09acd2ad37597a..57f295877d1abc5e5c8c55267470709e04712578 100644 (file)
--- a/crypto/mem.c
+++ b/crypto/mem.c
@@ -252,6 +252,8 @@ void *CRYPTO_malloc_locked(int num, const char *file, int line)
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
 
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
 

+       if (num < 0) return NULL;
+

        allow_customize = 0;
        if (malloc_debug_func != NULL)
                {
        allow_customize = 0;
        if (malloc_debug_func != NULL)
                {


@@ -291,6 +293,8 @@ void *CRYPTO_malloc(int num, const char *file, int line)
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
 
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
 

+       if (num < 0) return NULL;
+

        allow_customize = 0;
        if (malloc_debug_func != NULL)
                {
        allow_customize = 0;
        if (malloc_debug_func != NULL)
                {


@@ -319,6 +323,9 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
 
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);
 
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);

+
+       if (num < 0) return NULL;
+

        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
        ret = realloc_ex_func(str,num,file,line);
        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
        ret = realloc_ex_func(str,num,file,line);


@@ -338,6 +345,9 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,
 
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);
 
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);

+
+       if (num < 0) return NULL;
+

        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
        ret=malloc_ex_func(num,file,line);
        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
        ret=malloc_ex_func(num,file,line);