aboutsummaryrefslogtreecommitdiff
path: root/libio
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2005-10-14 06:25:55 +0000
committerUlrich Drepper <drepper@redhat.com>2005-10-14 06:25:55 +0000
commit6cebdfd8f320318ad5b32d2905711cd7ec020cd6 (patch)
tree47cf76ea08b92b70d097acaf97d0eeb51e8af67d /libio
parent513bbb254d123f72b60be5c935666a9b841bedc5 (diff)
downloadglibc-6cebdfd8f320318ad5b32d2905711cd7ec020cd6.zip
glibc-6cebdfd8f320318ad5b32d2905711cd7ec020cd6.tar.gz
glibc-6cebdfd8f320318ad5b32d2905711cd7ec020cd6.tar.bz2
[BZ #1405]
* libio/iogetdelim.c (_IO_getdelim): Fix truncation of return value. Avoid overflow in computation.
Diffstat (limited to 'libio')
-rw-r--r--libio/iogetdelim.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/libio/iogetdelim.c b/libio/iogetdelim.c
index 3d0c976..a362bf9 100644
--- a/libio/iogetdelim.c
+++ b/libio/iogetdelim.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1994,1996,1997,1998,2001,2003 Free Software Foundation, Inc.
+/* Copyright (C) 1994,1996-1998,2001,2003,2005 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
@@ -45,7 +45,7 @@ _IO_getdelim (lineptr, n, delimiter, fp)
int delimiter;
_IO_FILE *fp;
{
- int result;
+ _IO_ssize_t result;
_IO_ssize_t cur_len = 0;
_IO_ssize_t len;
@@ -91,6 +91,12 @@ _IO_getdelim (lineptr, n, delimiter, fp)
t = (char *) memchr ((void *) fp->_IO_read_ptr, delimiter, len);
if (t != NULL)
len = (t - fp->_IO_read_ptr) + 1;
+ if (__builtin_expect (cur_len + len + 1 < 0, 0))
+ {
+ __set_errno (EOVERFLOW);
+ result = -1;
+ goto unlock_return;
+ }
/* Make enough space for len+1 (for final NUL) bytes. */
needed = cur_len + len + 1;
if (needed > *n)