@@ -148,6 +148,14 @@ mbfl_memory_device_output(int c, void *data)
148
148
/* overflow */
149
149
return -1 ;
150
150
}
151
+
152
+ newlen = device -> length + device -> allocsz ;
153
+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
154
+ if (tmp == NULL ) {
155
+ return -1 ;
156
+ }
157
+ device -> length = newlen ;
158
+ device -> buffer = tmp ;
151
159
}
152
160
153
161
device -> buffer [device -> pos ++ ] = (unsigned char )c ;
@@ -168,6 +176,14 @@ mbfl_memory_device_output2(int c, void *data)
168
176
/* overflow */
169
177
return -1 ;
170
178
}
179
+
180
+ newlen = device -> length + device -> allocsz ;
181
+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
182
+ if (tmp == NULL ) {
183
+ return -1 ;
184
+ }
185
+ device -> length = newlen ;
186
+ device -> buffer = tmp ;
171
187
}
172
188
173
189
device -> buffer [device -> pos ++ ] = (unsigned char )((c >> 8 ) & 0xff );
@@ -190,6 +206,14 @@ mbfl_memory_device_output4(int c, void* data)
190
206
/* overflow */
191
207
return -1 ;
192
208
}
209
+
210
+ newlen = device -> length + device -> allocsz ;
211
+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
212
+ if (tmp == NULL ) {
213
+ return -1 ;
214
+ }
215
+ device -> length = newlen ;
216
+ device -> buffer = tmp ;
193
217
}
194
218
195
219
device -> buffer [device -> pos ++ ] = (unsigned char )((c >> 24 ) & 0xff );
@@ -221,6 +245,15 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, size_t
221
245
/* overflow */
222
246
return -1 ;
223
247
}
248
+
249
+ newlen = device -> length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE ;
250
+ tmp = (unsigned char * )mbfl_realloc ((void * )device -> buffer , newlen );
251
+ if (tmp == NULL ) {
252
+ return -1 ;
253
+ }
254
+
255
+ device -> length = newlen ;
256
+ device -> buffer = tmp ;
224
257
}
225
258
226
259
w = & device -> buffer [device -> pos ];
@@ -274,6 +307,19 @@ mbfl_wchar_device_output(int c, void *data)
274
307
/* overflow */
275
308
return -1 ;
276
309
}
310
+
311
+ newlen = device -> length + device -> allocsz ;
312
+ if (newlen > SIZE_MAX / sizeof (int )) {
313
+ /* overflow */
314
+ return -1 ;
315
+ }
316
+
317
+ tmp = (unsigned int * )mbfl_realloc ((void * )device -> buffer , newlen * sizeof (int ));
318
+ if (tmp == NULL ) {
319
+ return -1 ;
320
+ }
321
+ device -> length = newlen ;
322
+ device -> buffer = tmp ;
277
323
}
278
324
279
325
device -> buffer [device -> pos ++ ] = c ;
0 commit comments