From 1dfba2cdb8b2acdcbfee89e01eae25c90b00b6c4 Mon Sep 17 00:00:00 2001 From: wargio Date: Mon, 6 Jul 2026 09:06:13 +0800 Subject: [PATCH] Harden rz_str_append to prevent sum overflow --- librz/util/str.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/librz/util/str.c b/librz/util/str.c index bbc90e0721..0611e013bf 100644 --- a/librz/util/str.c +++ b/librz/util/str.c @@ -1161,9 +1161,15 @@ RZ_API RZ_OWN char *rz_str_append(RZ_OWN RZ_NULLABLE char *ptr, const char *stri if (RZ_STR_ISEMPTY(string)) { return ptr; } - int plen = strlen(ptr); - int slen = strlen(string); - char *newptr = realloc(ptr, slen + plen + 1); + size_t plen = strlen(ptr); + size_t slen = strlen(string); + size_t new_size = slen + plen + 1; + if (new_size < RZ_MAX(plen, slen)) { + rz_warn_if_reached(); + free(ptr); + return NULL; + } + char *newptr = realloc(ptr, new_size); if (!newptr) { free(ptr); return NULL;