Integer overflow in allocator call (#4980)

bloomberg · Oct 2, 2024 · a6a35c9 · a6a35c9
1 parent 62dc695
commit a6a35c9
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/groups/bdl/bdlcc/bdlcc_skiplist.cpp b/groups/bdl/bdlcc/bdlcc_skiplist.cpp
@@ -291,16 +291,16 @@ void SkipList_PoolManager::replenish(Pool *pool)
 
     BSLS_ASSERT(0 == pool->d_freeList);
 
-    int objectSize = pool->d_objectSize;
-    int numObjects = pool->d_numObjectsToAllocate;
+    BSLS_ASSERT(0 < pool->d_objectSize);
+    BSLS_ASSERT(0 < pool->d_numObjectsToAllocate);
 
-    BSLS_ASSERT(0 < objectSize);
-    BSLS_ASSERT(0 < numObjects);
+    size_t objectSize = pool->d_objectSize;
+    size_t numObjects = pool->d_numObjectsToAllocate;
 
     char *start = static_cast<char *>(d_blockList.allocate(
                                                      numObjects * objectSize));
 
-    char *end = start + (numObjects - 1) * objectSize;
+    char *end = start + (numObjects - 1U) * objectSize;
     Node *last = toNode(end);
     for (char *p = start; p < end; p += objectSize) {
         Node *n = toNode(p);