diff options
author | Sergey Sharybin <sergey.vfx@gmail.com> | 2020-03-06 17:33:47 +0300 |
---|---|---|
committer | Sergey Sharybin <sergey.vfx@gmail.com> | 2020-03-06 17:35:52 +0300 |
commit | a16e4652e3c80504790730b66145b7aef14b3648 (patch) | |
tree | 3e260bd4446f432227e4d4656e34a0368de655c5 /source/blender/blenlib/intern/BLI_mempool.c | |
parent | c60366c01fc77b83868bf8080bcf2cb48a4edadf (diff) |
Fix integer overflow in BLI_mempool_as_arrayN()
`(size_t)(int * int)` will actually cast overflown integer to size_t,
which isn't what was intended here. Correct thing would be to cast
in the following manner `(size_t)int * int`.
In this particular case can as well use function which is designed to
allocate an array of memory without overflow.
Diffstat (limited to 'source/blender/blenlib/intern/BLI_mempool.c')
-rw-r--r-- | source/blender/blenlib/intern/BLI_mempool.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/blender/blenlib/intern/BLI_mempool.c b/source/blender/blenlib/intern/BLI_mempool.c index 2b931507633..4182aab2190 100644 --- a/source/blender/blenlib/intern/BLI_mempool.c +++ b/source/blender/blenlib/intern/BLI_mempool.c @@ -526,7 +526,7 @@ void BLI_mempool_as_array(BLI_mempool *pool, void *data) */ void *BLI_mempool_as_arrayN(BLI_mempool *pool, const char *allocstr) { - char *data = MEM_mallocN((size_t)(pool->totused * pool->esize), allocstr); + char *data = MEM_malloc_arrayN(pool->totused, pool->esize, allocstr); BLI_mempool_as_array(pool, data); return data; } |