Fix a SIZE_T_CEILING check in torgzip.c; noticed by cypherpunks

This commit is contained in:
Nick Mathewson 2011-01-05 12:42:34 -05:00
parent 64798dab4f
commit d14b0d54d2

View File

@ -247,7 +247,7 @@ tor_gzip_uncompress(char **out, size_t *out_len,
out_size = in_len * 2; /* guess 50% compression. */
if (out_size < 1024) out_size = 1024;
if (out_size > SIZE_T_CEILING || out_size > UINT_MAX)
if (out_size >= SIZE_T_CEILING || out_size > UINT_MAX)
goto err;
*out = tor_malloc(out_size);