about summary refs log tree commit diff
path: root/posix/regexec.c
diff options
context:
space:
mode:
authorPaul Eggert <eggert@cs.ucla.edu>2010-01-22 12:22:18 -0800
committerUlrich Drepper <drepper@redhat.com>2010-01-22 12:22:18 -0800
commit42a2c9b5c3c92f7e2f556d7bc9dc80e557484574 (patch)
treec813ae09a934ebd6900f320b7d31baebfd347ad8 /posix/regexec.c
parenteadc09f22cd81dd0153fba0fd8514261ea9b4196 (diff)
downloadglibc-42a2c9b5c3c92f7e2f556d7bc9dc80e557484574.tar.gz
glibc-42a2c9b5c3c92f7e2f556d7bc9dc80e557484574.tar.xz
glibc-42a2c9b5c3c92f7e2f556d7bc9dc80e557484574.zip
regexec.c: avoid overflow in computing sum of lengths
Diffstat (limited to 'posix/regexec.c')
-rw-r--r--posix/regexec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/posix/regexec.c b/posix/regexec.c
index 11f3d31128..bad52ac2e0 100644
--- a/posix/regexec.c
+++ b/posix/regexec.c
@@ -370,7 +370,7 @@ re_search_2_stub (bufp, string1, length1, string2, length2, start, range, regs,
   int len = length1 + length2;
   char *s = NULL;
 
-  if (BE (length1 < 0 || length2 < 0 || stop < 0, 0))
+  if (BE (length1 < 0 || length2 < 0 || stop < 0 || len < length1, 0))
     return -2;
 
   /* Concatenate the strings.  */