jyapayne/musl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix twos complement overflow bug in mem streams boundary check

Browse source 
the expression -off is not safe in case off is the most-negative
value. instead apply - to base which is known to be non-negative and
bounded within sanity.
This commit is contained in:
Rich Felker 2011-09-04 00:06:01 -04:00
commit 32d67e938e
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/stdio/open_memstream.c
View file

@ -28,7 +28,7 @@ static off_t ms_seek(FILE *f, off_t off, int whence)
errno = EINVAL; errno = EINVAL;
return -1; return -1;
} }
if (-off > base || off > SSIZE_MAX-base) goto fail; if (off < -base || off > SSIZE_MAX-base) goto fail;
return c->pos = base+off; return c->pos = base+off;
} }

2
src/stdio/open_wmemstream.c
View file

@ -29,7 +29,7 @@ static off_t wms_seek(FILE *f, off_t off, int whence)
errno = EINVAL; errno = EINVAL;
return -1; return -1;
} }
if (-off > base || off > SSIZE_MAX/4-base) goto fail; if (off < -base || off > SSIZE_MAX/4-base) goto fail;
memset(&c->mbs, 0, sizeof c->mbs); memset(&c->mbs, 0, sizeof c->mbs);
return c->pos = base+off; return c->pos = base+off;
} }