Update.

	* stdlib/random_r.c (__setstate_r): Also compute end_ptr
	correctly.
	(__initstate_r): Set errno on error.
	(__random_r): Likewise.
	(__setstate_r): Correct offset when computing
	new rptr and fptr.  Test for arg_state being NULL.
	Reported by Michael Fischer <fischer@cs.yale.edu>.

1 files changed, 4 insertions, 2 deletions

diff --git a/stdlib/random_r.c b/stdlib/random_r.c
index 1d9e56f19b..120fceee11 100644
--- a/stdlib/random_r.c
+++ b/stdlib/random_r.c
@@ -249,6 +249,7 @@ __initstate_r (seed, arg_state, n, buf)
   return 0;
 
  fail:
+  __set_errno (EINVAL);
   return -1;
 }
 
@@ -274,7 +275,7 @@ __setstate_r (arg_state, buf)
   int degree;
   int separation;
 
-  if (buf == NULL)
+  if (arg_state == NULL || buf == NULL)
     goto fail;
 
   old_type = buf->rand_type;
@@ -300,7 +301,7 @@ __setstate_r (arg_state, buf)
     }
   buf->state = &new_state[1];
   /* Set end_ptr too.  */
-  buf->end_ptr = &new_state[degree];
+  buf->end_ptr = &new_state[1 + degree];
 
   return 0;
 
@@ -369,6 +370,7 @@ __random_r (buf, result)
   return 0;
 
  fail:
+  __set_errno (EINVAL);
   return -1;
 }