On Win32, experiment with limiting overflow multiplication to 32-bit operands because the compiler runtime may not have an implementation.

Author: millenomi

CoreFoundation/Base.subproj/CFOverflow.h

@@ -75,4 +75,18 @@ CF_INLINE _CFOverflowResult _CFPointerSumWouldOverflow(void const *p, size_t n,
     return result;
 }
 
+#if TARGET_OS_WIN32
+CF_INLINE bool _CFMultiplyBufferSizeWithoutOverflow(size_t a, size_t b, size_t *res) {
+    int32_t res32 = 0;
+    if (!os_mul_overflow((int32_t)a, (int32_t)b, &res32)) {
+        *res = res32;
+        return true;
+    } else {
+        return false;
+    }
+}
+#else
+#define _CFMultiplyBufferSizeWithoutOverflow(a, b, res) (os_mul_overflow((a), (b), (res)) == 0)
+#endif
+
 #endif /* CFOverflow_h */

CoreFoundation/URL.subproj/CFURLComponents_URIParser.c

@@ -281,7 +281,7 @@ CF_EXPORT CFStringRef _CFStringCreateByAddingPercentEncodingWithAllowedCharacter
             else {
                 // not big enough? malloc it.
                 size_t mallocSize;
-                if ( !os_mul_overflow(maxBufferSize, 4, &mallocSize) ) {
+                if ( !_CFMultiplyBufferSizeWithoutOverflow(maxBufferSize, 4, &mallocSize) ) {
                     inBuf = (UInt8 *)malloc(mallocSize);
                 }
             }
@@ -456,7 +456,7 @@ CF_EXPORT CFStringRef _CFStringCreateByRemovingPercentEncoding(CFAllocatorRef al
             else {
                 // not big enough? malloc it.
                 size_t mallocSize;
-                if ( !os_mul_overflow(maxBufferSize, 2, &mallocSize) ) {
+                if ( !_CFMultiplyBufferSizeWithoutOverflow(maxBufferSize, 2, &mallocSize) ) {
                     encodedBuf = (UInt8 *)malloc(mallocSize);
                 }
             }