瀏覽代碼

Fix possible integer overflow of size + 1

nightmareci 11 月之前
父節點
當前提交
2e381a717f
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      src/io/SDL_iostream.c

+ 2 - 2
src/io/SDL_iostream.c

@@ -1153,7 +1153,7 @@ void *SDL_LoadFile_IO(SDL_IOStream *src, size_t *datasize, bool closeio)
         size = FILE_CHUNK_SIZE;
         size = FILE_CHUNK_SIZE;
         loading_chunks = true;
         loading_chunks = true;
     }
     }
-    if (size >= SDL_SIZE_MAX) {
+    if (size >= SDL_SIZE_MAX - 1) {
         goto done;
         goto done;
     }
     }
     data = (char *)SDL_malloc((size_t)(size + 1));
     data = (char *)SDL_malloc((size_t)(size + 1));
@@ -1166,7 +1166,7 @@ void *SDL_LoadFile_IO(SDL_IOStream *src, size_t *datasize, bool closeio)
         if (loading_chunks) {
         if (loading_chunks) {
             if ((size_total + FILE_CHUNK_SIZE) > size) {
             if ((size_total + FILE_CHUNK_SIZE) > size) {
                 size = (size_total + FILE_CHUNK_SIZE);
                 size = (size_total + FILE_CHUNK_SIZE);
-                if (size >= SDL_SIZE_MAX) {
+                if (size >= SDL_SIZE_MAX - 1) {
                     newdata = NULL;
                     newdata = NULL;
                 } else {
                 } else {
                     newdata = (char *)SDL_realloc(data, (size_t)(size + 1));
                     newdata = (char *)SDL_realloc(data, (size_t)(size + 1));