Project

General

Profile

Actions
Copy link

Bug #2130

closed

malloc(SIZE_MAX) returns a buffer sized for 0.

Added by vsrinivas about 13 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Userland
Target version:
6.2
Start date:
Due date:
% Done:

0%

Estimated time:

Description

malloc(SIZE_MAX) returns a buffer sized for 0 bytes on i386; this is because the
addition and mask on nmalloc.c line 824 can overflow.

Actions
Copy link

Also available in: Atom PDF