Commit ee679112 authored by Marc Hoersken's avatar Marc Hoersken
Browse files

multi.c: fix possible invalid memory access in case nfds overflows 

ufds might not be allocated in case nfds overflows to zero while
extra_nfds is still non-zero. udfs is then accessed within the
extra_nfds-based for loop.
parent 549b4a65

lib/multi.c

+1 −1
Original line number Diff line number Diff line
@@ -828,7 +828,7 @@ CURLMcode curl_multi_wait(CURLM *multi_handle, 
  curlfds = nfds; /* number of internal file descriptors */

  nfds += extra_nfds; /* add the externally provided ones */



  if(nfds) {

  if(nfds || extra_nfds) {

    ufds = malloc(nfds * sizeof(struct pollfd));

    if(!ufds)

      return CURLM_OUT_OF_MEMORY;