From 1ea7255f8b0661cdfabbd13f8f443f81665a07e0 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Sat, 3 Aug 2024 22:59:12 -0700 Subject: [PATCH] shuf: avoid integer overflow on huge inputs * gl/lib/randperm.c: Include . (randperm_bound): Return SIZE_MAX if the multiplication overflows. Do not overflow when converting bit count to byte count. --- gl/lib/randperm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/gl/lib/randperm.c b/gl/lib/randperm.c index 50328cd9a5..14a3045241 100644 --- a/gl/lib/randperm.c +++ b/gl/lib/randperm.c @@ -23,6 +23,7 @@ #include #include +#include #include #include @@ -39,13 +40,15 @@ randperm_bound (size_t h, size_t n) { /* Upper bound on number of bits needed to generate the first number of the permutation. */ - uintmax_t lg_n = stdc_bit_width (n) + 1; + unsigned int lg_n = stdc_bit_width (n) + 1; - /* Upper bound on number of bits needed to generated the first H elements. */ - uintmax_t ar = lg_n * h; + /* Upper bound on number of bits needed to generate the first H elements. */ + uintmax_t ar; + if (ckd_mul (&ar, lg_n, h)) + return SIZE_MAX; /* Convert the bit count to a byte count. */ - size_t bound = (ar + CHAR_BIT - 1) / CHAR_BIT; + size_t bound = ar / CHAR_BIT + (ar % CHAR_BIT != 0); return bound; } -- 2.47.2