-
由 Markus Armbruster 提交于
Happily passes (size_t)-1 to rom_add_blob_fixed(), which promptly dies attempting to malloc that much. Spotted by Coverity. Bonus fix for ROMs larger than INT_MAX bytes: return ssize_t instead of int. Bug can't bite, because the only user load_aout() limits ROM size to an int value. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
725e14e9