From 863da7083fb2793457d4d4cb5d97104601a7de46 Mon Sep 17 00:00:00 2001 From: dzaima Date: Wed, 3 Apr 2024 18:27:25 +0300 Subject: [PATCH] OOM on too large apd_sh_init result --- src/utils/mut.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/utils/mut.c b/src/utils/mut.c index 1deea741..cfbce2d6 100644 --- a/src/utils/mut.c +++ b/src/utils/mut.c @@ -601,7 +601,7 @@ NOINLINE void apd_sh_init(ApdMut* m, B x) { ur rr0 = m->rr0; // need to be read before union fields are written usz* rsh0 = m->rsh0; // ↑ - ux ria; + usz ria; if (rr0==1) ria = *rsh0; else if (rr0!=0) ria = shProd(rsh0, 0, rr0); else ria = 1; @@ -632,7 +632,7 @@ NOINLINE void apd_sh_init(ApdMut* m, B x) { else { m->apd=apd_sh2_fns[xe]; m->cr=xr; } // csh written on result shape creation rr+= xr; m->cia = xia; - ria*= xia; + if (mulOn(ria, xia)) thrOOM(); pos0 = xia; } if (xe==el_B) {