diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c index 88864ae22b8..6dcf181bff9 100644 --- a/erts/emulator/drivers/common/inet_drv.c +++ b/erts/emulator/drivers/common/inet_drv.c @@ -14696,8 +14696,12 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event) ASSERT(IS_SCTP(desc)); bufsz = udesc->i_ptr - udesc->i_buf->orig_bytes; if (udesc->i_bufsz - bufsz < desc->bufsz) { /* Headroom */ - bufsz = udesc->i_bufsz + desc->bufsz; - if ((tmp = realloc_buffer(udesc->i_buf, bufsz)) == NULL) { + int new_bufsz; + new_bufsz = udesc->i_bufsz + desc->bufsz; + if (new_bufsz < 0) /* Overflow? */ + new_bufsz = bufsz + desc->bufsz; /* Minimal realloc */ + if (new_bufsz < 0 /* Also overflow? */ || + (tmp = realloc_buffer(udesc->i_buf, new_bufsz)) == NULL) { release_buffer(udesc->i_buf); udesc->i_buf = NULL; return packet_error(udesc, ENOMEM); @@ -14706,7 +14710,7 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event) tmp->orig_bytes + (udesc->i_ptr - udesc->i_buf->orig_bytes); udesc->i_buf = tmp; - udesc->i_bufsz = bufsz; + udesc->i_bufsz = new_bufsz; } have_fragment = TRUE; } else