4 ms·
Your check is wrong because '(2 * len) + 1' will (just barely) overflow if len is on the upper end of the checked range. However, if it works incorrectly even
by comex 13y ago
Your check is wrong because '(2 * len) + 1' will (just barely) overflow if len is on the upper end of the checked range. However, if it works incorrectly even when len is not, I'd call that a compiler bug. Note that newer versions of GCC seem to be fine.
- uaygsfdbzf 13y agoWhy it will overflow? malloc accepts size_t as a parameter (which is unsigned integer), before giving it the (2 * len) + 1 I check if len is smaller than 1024^3 (1 GiB), so (2 * len) + 1 can not be greater than 2147483649 (which is 0x80000001).
- sharth 13y agoThe overflow happens before the conversion to unsigned.