--- a/file.c 2020-04-07 21:18:24.000000000 +0200 +++ b/file.c 2020-04-22 20:11:45.714713362 +0200 @@ -493,7 +493,8 @@ tmp->data = (uint8_t *)malloc(len2); if (tmp->data != NULL) tmp->len = len2; max_lines = (len2 / 20 + 1024) & ~(size_t)1023; - if (max_lines > SIZE_MAX / sizeof *tmp->line) max_lines = SIZE_MAX / sizeof *tmp->line; /* overflow */ + if (max_lines >= INT32_MAX / sizeof *tmp->line) + max_lines = (INT32_MAX - 1) / sizeof *tmp->line; /* overflow */ tmp->line = (size_t *)malloc(max_lines * sizeof *tmp->line); if (tmp->line == NULL) max_lines = 0; } @@ -718,8 +719,11 @@ last_ubuff = ubuff; tmp->lines = lines; if (lines != max_lines) { + if (lines >= INT32_MAX / sizeof *tmp->line) + lines = (INT32_MAX - 1) / sizeof *tmp->line; /* overflow */ size_t *d = (size_t *)realloc(tmp->line, lines * sizeof *tmp->line); - if (lines == 0 || d != NULL) tmp->line = d; + if (lines == 0 || d != NULL) + tmp->line = d; } } tmp->len = fp;