
# HG changeset patch
# User Wan-Teh Chang <wtc@google.com>
# Date 1383160555 25200
# Node ID 4df6bc35be64c660cd9770637a2f9e8247c6c407
# Parent  9b26e99c21c37c97d3ca286c3ac96e2fd82e980d
Bug 927687: Avoid unsigned integer wrapping in PL_ArenaAllocate. r=rrelyea.

Index: nspr-4.9.2/mozilla/nsprpub/lib/ds/plarena.c
===================================================================
--- nspr-4.9.2.orig/mozilla/nsprpub/lib/ds/plarena.c	2012-07-20 08:32:28.000000000 +0200
+++ nspr-4.9.2/mozilla/nsprpub/lib/ds/plarena.c	2013-12-16 17:09:04.147721841 +0100
@@ -196,8 +196,12 @@ PR_IMPLEMENT(void *) PL_ArenaAllocate(PL
     /* attempt to allocate from the heap */ 
     {  
         PRUint32 sz = PR_MAX(pool->arenasize, nb);
-        sz += sizeof *a + pool->mask;  /* header and alignment slop */
-        a = (PLArena*)PR_MALLOC(sz);
+        if (PR_UINT32_MAX - sz < sizeof *a + pool->mask) {
+            a = NULL;
+        } else {
+            sz += sizeof *a + pool->mask;  /* header and alignment slop */
+            a = (PLArena*)PR_MALLOC(sz);
+        }
         if ( NULL != a )  {
             a->limit = (PRUword)a + sz;
             a->base = a->avail = (PRUword)PL_ARENA_ALIGN(pool, a + 1);
