17.12.2015 02:43, Leo Liu wrote: > - pNewProp->data = value; > + if (!(pNewProp->data = malloc(len * format/8))) > + return BadAlloc; > + memcpy(pNewProp->data, value, (len * format/8)); Is there any guarantee that len * format/8 will not overflow? -- Alexander E. Patrakov