diff options
| author | Joseph Myers <joseph@codesourcery.com> | 2012-09-04 11:24:43 +0000 |
|---|---|---|
| committer | Joseph Myers <joseph@codesourcery.com> | 2012-09-04 11:24:43 +0000 |
| commit | 60160d83a09c659d8d9338b210ff92be77cc87d5 (patch) | |
| tree | bf83de97019d483c4081255a795f1187c5be0103 /libio/iogetdelim.c | |
| parent | bcd6c8dc64e8fdd6906018ca5e8913e2f111a023 (diff) | |
| download | glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.tar.gz glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.tar.xz glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.zip | |
Fix iogetdelim.c (latent) integer overflow (bug 9914).
Diffstat (limited to 'libio/iogetdelim.c')
| -rw-r--r-- | libio/iogetdelim.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libio/iogetdelim.c b/libio/iogetdelim.c index 405b65f1e1..bf4b0f776a 100644 --- a/libio/iogetdelim.c +++ b/libio/iogetdelim.c @@ -29,6 +29,7 @@ #include "libioP.h" #include <string.h> #include <errno.h> +#include <limits.h> /* Read up to (and including) a TERMINATOR from FP into *LINEPTR (and null-terminate it). *LINEPTR is a pointer returned from malloc (or @@ -89,7 +90,7 @@ _IO_getdelim (lineptr, n, delimiter, fp) t = (char *) memchr ((void *) fp->_IO_read_ptr, delimiter, len); if (t != NULL) len = (t - fp->_IO_read_ptr) + 1; - if (__builtin_expect (cur_len + len + 1 < 0, 0)) + if (__builtin_expect (len >= SSIZE_MAX - cur_len, 0)) { __set_errno (EOVERFLOW); result = -1; |