mirrors/musl
1
0
Fork 0
mirror of https://git.musl-libc.org/git/musl synced 2025-02-09 14:54:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix twos complement overflow bug in mem streams boundary check

Browse Source 
the expression -off is not safe in case off is the most-negative
value. instead apply - to base which is known to be non-negative and
bounded within sanity.
This commit is contained in:
Rich Felker 2011-09-04 00:06:01 -04:00
parent d4fa6f0e08
commit 32d67e938e
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/stdio/open_memstream.c
View File

@ -28,7 +28,7 @@ static off_t ms_seek(FILE *f, off_t off, int whence)
errno = EINVAL;
return -1;
}
if (-off > base || off > SSIZE_MAX-base) goto fail;
if (off < -base || off > SSIZE_MAX-base) goto fail;
return c->pos = base+off;
}

2
src/stdio/open_wmemstream.c
View File

@ -29,7 +29,7 @@ static off_t wms_seek(FILE *f, off_t off, int whence)
errno = EINVAL;
return -1;
}
if (-off > base || off > SSIZE_MAX/4-base) goto fail;
if (off < -base || off > SSIZE_MAX/4-base) goto fail;
memset(&c->mbs, 0, sizeof c->mbs);
return c->pos = base+off;
}