Browse Source

fix twos complement overflow bug in mem streams boundary check

the expression -off is not safe in case off is the most-negative
value. instead apply - to base which is known to be non-negative and
bounded within sanity.
rs-1.0
Rich Felker 15 years ago
parent
commit
32d67e938e
  1. 2
      src/stdio/open_memstream.c
  2. 2
      src/stdio/open_wmemstream.c

2
src/stdio/open_memstream.c

@ -28,7 +28,7 @@ static off_t ms_seek(FILE *f, off_t off, int whence)
errno = EINVAL;
return -1;
}
if (-off > base || off > SSIZE_MAX-base) goto fail;
if (off < -base || off > SSIZE_MAX-base) goto fail;
return c->pos = base+off;
}

2
src/stdio/open_wmemstream.c

@ -29,7 +29,7 @@ static off_t wms_seek(FILE *f, off_t off, int whence)
errno = EINVAL;
return -1;
}
if (-off > base || off > SSIZE_MAX/4-base) goto fail;
if (off < -base || off > SSIZE_MAX/4-base) goto fail;
memset(&c->mbs, 0, sizeof c->mbs);
return c->pos = base+off;
}

Loading…
Cancel
Save