Hacker News Reader

Your check is wrong because '(2 * len) + 1' will (just barely) overflow if len is on the upper end of the checked range. However, if it works incorrectly even when len is not, I'd call that a compiler bug. Note that newer versions of GCC seem to be fine.

View on HN

Why it will overflow? malloc accepts size_t as a parameter (which is unsigned integer), before giving it the (2 * len) + 1 I check if len is smaller than 1024^3 (1 GiB), so (2 * len) + 1 can not be greater than 2147483649 (which is 0x80000001).

The overflow happens before the conversion to unsigned.

Reply on news.ycombinator.com