From 0ecb77617cedbf0b82c9f1ed78af61d47a6c3a32 Mon Sep 17 00:00:00 2001
From: Arnaud Cornet <nohar@t1r.net>
Date: Mon, 29 Dec 2008 15:31:32 +0100
Subject: [PATCH] Sanitize bip_(m|re)alloc size.

---
 src/conf.y |  8 ++------
 src/irc.c  |  3 +--
 src/util.c | 13 +++++++++++--
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/conf.y b/src/conf.y
index b90c101..3c23ce7 100644
--- a/src/conf.y
+++ b/src/conf.y
@@ -36,9 +36,7 @@ list_t *root_list;
 struct tuple *tuple_i_new(int type, int i)
 {
 	struct tuple *t;
-	t = malloc(sizeof(struct tuple));
-	if (!t)
-		fatal("malloc");
+	t = bip_malloc(sizeof(struct tuple));
 	t->type = type;
 	t->ndata = i;
 	t->tuple_type = TUPLE_INT;
@@ -48,9 +46,7 @@ struct tuple *tuple_i_new(int type, int i)
 struct tuple *tuple_p_new(int type, void *p)
 {
 	struct tuple *t;
-	t = malloc(sizeof(struct tuple));
-	if (!t)
-		fatal("malloc");
+	t = bip_malloc(sizeof(struct tuple));
 	t->type = type;
 	t->pdata = p;
 	return t;
diff --git a/src/irc.c b/src/irc.c
index 9b45fae..aafc584 100644
--- a/src/irc.c
+++ b/src/irc.c
@@ -88,8 +88,7 @@ char *nick_from_ircmask(const char *mask)
 	char *ret;
 	size_t len;
 
-	if (!mask)
-		fatal("nick_from_ircmask");
+	assert(mask);
 
 	while (*nick && *nick != '!')
 		nick++;
diff --git a/src/util.c b/src/util.c
index 8f6c90f..c305819 100644
--- a/src/util.c
+++ b/src/util.c
@@ -18,6 +18,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
+#include <stdint.h>
 #include <string.h>
 #include <ctype.h>
 #include <sys/types.h>
@@ -41,7 +42,11 @@ void memory_fatal(void)
 
 void *bip_malloc(size_t size)
 {
-	void *r = malloc(size);
+	void *r;
+
+	assert(size < INT_MAX / 4);
+
+	r = malloc(size);
 	if (!r)
 		memory_fatal();
 	return r;
@@ -57,7 +62,11 @@ void *bip_calloc(size_t nmemb, size_t size)
 
 void *bip_realloc(void *ptr, size_t size)
 {
-	void *r = realloc(ptr, size);
+	void *r;
+
+	assert(size < INT_MAX / 4);
+
+	r = realloc(ptr, size);
 	if (size > 0 && r == NULL)
 		memory_fatal();
 	return r;