fixed security vulnerability in scratchpad for 32bit builds

squirrel/sqstate.cpp

@@ -374,15 +374,18 @@ void SQCollectable::RemoveFromChain(SQCollectable **chain,SQCollectable *c)
 SQChar* SQSharedState::GetScratchPad(SQInteger size)
 {
     SQInteger newsize;
-    if(size>0) {
-        if(_scratchpadsize < size) {
-            newsize = size + (size>>1);
-            _scratchpad = (SQChar *)SQ_REALLOC(_scratchpad,_scratchpadsize,newsize);
+    if (size > 0) {
+        if (_scratchpadsize < size) {
+            newsize = size + (size >> 1);
+            newsize = sq_max(newsize, size); //check for overflow
+            _scratchpad = (SQChar*)SQ_REALLOC(_scratchpad, _scratchpadsize, newsize);
             _scratchpadsize = newsize;
 
-        }else if(_scratchpadsize >= (size<<5)) {
+        }
+        else if (_scratchpadsize >= (size << 5)) {
             newsize = _scratchpadsize >> 1;
-            _scratchpad = (SQChar *)SQ_REALLOC(_scratchpad,_scratchpadsize,newsize);
+            newsize = sq_max(newsize, size); //check for overflow
+            _scratchpad = (SQChar*)SQ_REALLOC(_scratchpad, _scratchpadsize, newsize);
             _scratchpadsize = newsize;
         }
     }

squirrel/squtils.h

@@ -13,6 +13,7 @@ void sq_vm_free(void *p,SQUnsignedInteger size);
 #define SQ_REALLOC(__ptr,__oldsize,__size) sq_vm_realloc((__ptr),(__oldsize),(__size));
 
 #define sq_aligning(v) (((size_t)(v) + (SQ_ALIGNMENT-1)) & (~(SQ_ALIGNMENT-1)))
+#define sq_max(a, b) ((a) > (b) ? (a) : (b))
 
 //sqvector mini vector class, supports objects by value
 template<typename T> class sqvector