From 7c0334de3dd84a3c40ee5bdfb5a8e547445e25c9 Mon Sep 17 00:00:00 2001
From: Hiltjo Posthuma <hiltjo@codemadness.org>
Date: Tue, 27 Oct 2026 21:09:38 +0100
Subject: [PATCH] check integer overflow for multiplication before realloc

---
 dmenu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dmenu.c b/dmenu.c
index 2c64545..07ab089 100644
--- a/dmenu.c
+++ b/dmenu.c
@@ -1,6 +1,7 @@
 /* See LICENSE file for copyright and license details. */
 #include <ctype.h>
 #include <locale.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -556,6 +557,8 @@ readstdin(void)
 	for (i = 0; (len = getline(&line, &linesiz, stdin)) != -1; i++) {
 		if (i + 1 >= itemsiz) {
 			itemsiz += 256;
+			if (itemsiz > SIZE_MAX / sizeof(*items))
+				die("too many items");
 			if (!(items = realloc(items, itemsiz * sizeof(*items))))
 				die("cannot realloc %zu bytes:", itemsiz * sizeof(*items));
 		}