From 760063ab57aa42ea82f1bf5c9177c0cde206aeee Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Sat, 9 Aug 2014 17:37:02 +0200
Subject: cwfs: fix 32bit multiplication overflows for allocation sizes (thanks
 kenji okomoto)

---
 sys/src/cmd/cwfs/main.c   | 8 ++++----
 sys/src/cmd/cwfs/malloc.c | 6 +++---
 sys/src/cmd/cwfs/mworm.c  | 2 +-
 sys/src/cmd/cwfs/sub.c    | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/sys/src/cmd/cwfs/main.c b/sys/src/cmd/cwfs/main.c
index eaba6c1c1..97ce1cb42 100644
--- a/sys/src/cmd/cwfs/main.c
+++ b/sys/src/cmd/cwfs/main.c
@@ -323,15 +323,15 @@ main(int argc, char **argv)
 	netinit();
 	scsiinit();
 
-	files = ialloc(conf.nfile * sizeof(*files), 0);
+	files = ialloc((uintptr)conf.nfile * sizeof(*files), 0);
 	for(i=0; i < conf.nfile; i++) {
 		qlock(&files[i]);
 		qunlock(&files[i]);
 	}
 
-	wpaths = ialloc(conf.nwpath * sizeof(*wpaths), 0);
-	uid = ialloc(conf.nuid * sizeof(*uid), 0);
-	gidspace = ialloc(conf.gidspace * sizeof(*gidspace), 0);
+	wpaths = ialloc((uintptr)conf.nwpath * sizeof(*wpaths), 0);
+	uid = ialloc((uintptr)conf.nuid * sizeof(*uid), 0);
+	gidspace = ialloc((uintptr)conf.gidspace * sizeof(*gidspace), 0);
 
 	iobufinit();
 
diff --git a/sys/src/cmd/cwfs/malloc.c b/sys/src/cmd/cwfs/malloc.c
index 165599623..25ae33b5f 100644
--- a/sys/src/cmd/cwfs/malloc.c
+++ b/sys/src/cmd/cwfs/malloc.c
@@ -100,15 +100,15 @@ iobufinit(void)
 		nhiob++;
 	if(chatty)
 		print("\t%ud buffers; %ud hashes\n", niob, nhiob);
-	hiob = ialloc(nhiob * sizeof(Hiob), 0);
+	hiob = ialloc((uintptr)nhiob * sizeof(Hiob), 0);
 	hp = hiob;
 	for(i=0; i<nhiob; i++) {
 		lock(hp);
 		unlock(hp);
 		hp++;
 	}
-	p = ialloc(niob * sizeof(Iobuf), 0);
-	xiop = ialloc(niob * RBUFSIZE, 0);
+	p = ialloc((uintptr)niob * sizeof(Iobuf), 0);
+	xiop = ialloc((uintptr)niob * RBUFSIZE, 0);
 	hp = hiob;
 	for(i=0; i < niob; i++) {
 		qlock(p);
diff --git a/sys/src/cmd/cwfs/mworm.c b/sys/src/cmd/cwfs/mworm.c
index b4d444236..14e9dea5b 100644
--- a/sys/src/cmd/cwfs/mworm.c
+++ b/sys/src/cmd/cwfs/mworm.c
@@ -14,7 +14,7 @@ mcatinit(Device *d)
 		d->cat.ndev++;
 	}
 
-	list = ialloc(d->cat.ndev * sizeof(Device*), 0);
+	list = ialloc((uintptr)d->cat.ndev * sizeof(Device*), 0);
 	d->private = list;
 	for(x=d->cat.first; x; x=x->link) {
 		*list++ = x;
diff --git a/sys/src/cmd/cwfs/sub.c b/sys/src/cmd/cwfs/sub.c
index c73c3d3ab..bf9a59e1d 100644
--- a/sys/src/cmd/cwfs/sub.c
+++ b/sys/src/cmd/cwfs/sub.c
@@ -38,7 +38,7 @@ fs_chaninit(int count, int data)
 	Chan *cp, *icp;
 	int i;
 
-	p = ialloc(count * (sizeof(Chan)+data), 0);
+	p = ialloc((uintptr)count * (sizeof(Chan)+data), 0);
 	icp = (Chan*)p;
 	for(i = 0; i < count; i++) {
 		cp = (Chan*)p;
-- 
cgit v1.2.3