From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 5 Jan 2011 17:42:34 +0000 (-0500)
Subject: Fix a SIZE_T_CEILING check in torgzip.c; noticed by cypherpunks
X-Git-Tag: tor-0.2.1.29~6^2~5^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d14b0d54d2469744266769d7e61135d1aa1c9c11;p=thirdparty%2Ftor.git

Fix a SIZE_T_CEILING check in torgzip.c; noticed by cypherpunks
---

diff --git a/src/common/torgzip.c b/src/common/torgzip.c
index b44b159a46..7678668777 100644
--- a/src/common/torgzip.c
+++ b/src/common/torgzip.c
@@ -247,7 +247,7 @@ tor_gzip_uncompress(char **out, size_t *out_len,
 
   out_size = in_len * 2;  /* guess 50% compression. */
   if (out_size < 1024) out_size = 1024;
-  if (out_size > SIZE_T_CEILING || out_size > UINT_MAX)
+  if (out_size >= SIZE_T_CEILING || out_size > UINT_MAX)
     goto err;
 
   *out = tor_malloc(out_size);