D1904: bdiff: Handle the possibility of integer overflow when computing allocation size

[alex_gaynor (Alex Gaynor)]

alex_gaynor created this revision.
alex_gaynor added a reviewer: durin42.
Herald added a subscriber: mercurial-devel.
Herald added a reviewer: hg-reviewers.

REPOSITORY
  rHG Mercurial

BRANCH
  malloc-overflow (bookmark) on default (branch)

REVISION DETAIL
  https://phab.mercurial-scm.org/D1904

AFFECTED FILES
  mercurial/bdiff.c

CHANGE DETAILS

diff --git a/mercurial/bdiff.c b/mercurial/bdiff.c
--- a/mercurial/bdiff.c
+++ b/mercurial/bdiff.c
@@ -95,7 +95,7 @@
 
 	/* try to allocate a large hash table to avoid collisions */
 	for (scale = 4; scale; scale /= 2) {
-		h = (struct pos *)malloc(scale * buckets * sizeof(struct pos));
+		h = (struct pos *)calloc(buckets, scale * sizeof(struct pos));
 		if (h)
 			break;
 	}



To: alex_gaynor, durin42, #hg-reviewers
Cc: mercurial-devel