From f333871bc0e81046afe56c8334a82cfd28aa82c7 Mon Sep 17 00:00:00 2001
From: Kyle Banker <kylebanker@gmail.com>
Date: Mon, 8 Aug 2011 18:23:40 -0400
Subject: [PATCH] RUBY-294 fix potential infinite loop

---
 ext/cbson/bson_buffer.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ext/cbson/bson_buffer.c b/ext/cbson/bson_buffer.c
index 7811178..2ba3902 100644
--- a/ext/cbson/bson_buffer.c
+++ b/ext/cbson/bson_buffer.c
@@ -62,12 +62,17 @@ int bson_buffer_free(bson_buffer_t buffer) {
  * Return non-zero on allocation failure. */
 static int buffer_grow(bson_buffer_t buffer, int min_length) {
     int size = buffer->size;
+    int old_size;
     char* old_buffer = buffer->buffer;
     if (size >= min_length) {
         return 0;
     }
     while (size < min_length) {
+        old_size = size;
         size *= 2;
+        /* Prevent potential overflow. */
+        if( size < old_size )
+            size = min_length;
     }
     buffer->buffer = (char*)realloc(buffer->buffer, sizeof(char) * size);
     if (buffer->buffer == NULL) {
@@ -117,7 +122,7 @@ int bson_buffer_write(bson_buffer_t buffer, const char* data, int size) {
 int bson_buffer_write_at_position(bson_buffer_t buffer, bson_buffer_position position,
                              const char* data, int size) {
     if (position + size > buffer->size) {
-        buffer_free(buffer);
+        bson_buffer_free(buffer);
         return 1;
     }