diff --git a/caca/canvas.c b/caca/canvas.c index 62b72b7..418ca54 100644 --- a/caca/canvas.c +++ b/caca/canvas.c @@ -375,6 +375,13 @@ int caca_resize(caca_canvas_t *cv, int width, int height) return -1; } int new_size = width * height; + /* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit + * systems */ + if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t)) + { + seterrno(EOVERFLOW); + return -1; + } old_width = cv->width; old_height = cv->height; diff --git a/caca/frame.c b/caca/frame.c index c960092..9f88392 100644 --- a/caca/frame.c +++ b/caca/frame.c @@ -147,6 +147,15 @@ int caca_create_frame(caca_canvas_t *cv, int id) int size = cv->width * cv->height; int f; + + /* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit + * systems */ + if (size > 0 && (size_t)size > SIZE_MAX / sizeof(uint32_t)) + { + seterrno(EOVERFLOW); + return -1; + } + if(id < 0) id = 0; else if(id > cv->framecount)