lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-01 10:06:57 +03:00
Code Activity

Fix iogetdelim.c (latent) integer overflow (bug 9914).

Browse Source
This commit is contained in:
Joseph Myers
2012-09-04 11:24:43 +00:00
parent bcd6c8dc64
commit 60160d83a0
3 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libio/iogetdelim.c
View File

@ -29,6 +29,7 @@
#include "libioP.h"
#include <string.h>
#include <errno.h>
#include <limits.h>
/* Read up to (and including) a TERMINATOR from FP into *LINEPTR
(and null-terminate it). *LINEPTR is a pointer returned from malloc (or
@ -89,7 +90,7 @@ _IO_getdelim (lineptr, n, delimiter, fp)
t = (char *) memchr ((void *) fp->_IO_read_ptr, delimiter, len);
if (t != NULL)
len = (t - fp->_IO_read_ptr) + 1;
if (__builtin_expect (cur_len + len + 1 < 0, 0))
if (__builtin_expect (len >= SSIZE_MAX - cur_len, 0))
{
__set_errno (EOVERFLOW);
result = -1;