fileio: add missing overflow checks to read_full_virtual_file()

given the source is trusted this is probably not a biggie, but let's
better be safe than sorry.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/basic/fileio.c b/src/basic/fileio.c
index f3a28398b7..6e42b60c3f 100644
--- a/src/basic/fileio.c
+++ b/src/basic/fileio.c
@@ -404,10 +404,14 @@ int read_full_virtual_file(const char *filename, char **ret_contents, size_t *re
 
                 /* Be prepared for files from /proc which generally report a file size of 0. */
                 if (st.st_size > 0) {
+                        if (st.st_size > SSIZE_MAX) /* safety check in case off_t is 64bit and size_t 32bit */
+                                return -E2BIG;
+
                         size = st.st_size;
                         n_retries--;
                 } else
-                        size = size * 2;
+                        /* Double the buffer size (saturate in case of overflow) */
+                        size = size > SSIZE_MAX / 2 ? SSIZE_MAX : size * 2;
 
                 if (size > READ_FULL_BYTES_MAX)
                         return -E2BIG;