From 73008f26ea38fa2a4c25a2d7fbbd2807ead48fba Mon Sep 17 00:00:00 2001
From: Qualys Security Advisory <qsa@qualys.com>
Date: Thu, 1 Jan 1970 00:00:00 +0000
Subject: [PATCH] 0020-pidof: Prevent integer overflows with grow_size().

Note: unlike "size" and "omit_size", "path_alloc_size" is not multiplied
by "sizeof(struct el)" but the checks in grow_size() allow for a roughly
100MB path_alloc_size, which should be more than enough for readlink().
---
 pidof.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pidof.c b/pidof.c
index c65aaadb..c4288115 100644
--- a/pidof.c
+++ b/pidof.c
@@ -21,6 +21,7 @@
 #include <stdio.h>
 #include <unistd.h>
 #include <getopt.h>
+#include <limits.h>
 #include <sys/types.h>
 
 #include "c.h"
@@ -30,7 +31,12 @@
 #include <proc/procps.h>
 
 
-#define grow_size(x)	(x = x * 5 / 4 + 1024)
+#define grow_size(x) do { \
+	if ((x) < 0 || (size_t)(x) >= INT_MAX / 5 / sizeof(struct el)) \
+		xerrx(EXIT_FAILURE, _("integer overflow")); \
+	(x) = (x) * 5 / 4 + 1024; \
+} while (0)
+
 #define safe_free(x)	if (x) { free(x); x=NULL; }