diff options
| author | Rich Felker <dalias@aerifal.cx> | 2011-09-04 10:29:04 -0400 |
|---|---|---|
| committer | Rich Felker <dalias@aerifal.cx> | 2011-09-04 10:29:04 -0400 |
| commit | 7ee3dcb3c603b20fcd4547ffb00e11701c6d1cf4 (patch) | |
| tree | de55d7b177cbe5f095ac2745e65e5544254fc067 /src/stdio/open_memstream.c | |
| parent | c88f36f55623124d09f48631974ca38aaec00057 (diff) | |
| download | musl-7ee3dcb3c603b20fcd4547ffb00e11701c6d1cf4.tar.gz musl-7ee3dcb3c603b20fcd4547ffb00e11701c6d1cf4.tar.bz2 musl-7ee3dcb3c603b20fcd4547ffb00e11701c6d1cf4.tar.xz musl-7ee3dcb3c603b20fcd4547ffb00e11701c6d1cf4.zip | |
memstreams: fix incorrect handling of file pos > current size
the addition is safe and cannot overflow because both operands are
positive when considered as signed quantities.
Diffstat (limited to 'src/stdio/open_memstream.c')
| -rw-r--r-- | src/stdio/open_memstream.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/stdio/open_memstream.c b/src/stdio/open_memstream.c index 7fc16204..687e818d 100644 --- a/src/stdio/open_memstream.c +++ b/src/stdio/open_memstream.c @@ -32,8 +32,8 @@ static size_t ms_write(FILE *f, const unsigned char *buf, size_t len) f->wpos = f->wbase; if (ms_write(f, f->wbase, len2) < len2) return 0; } - if (len >= c->space - c->pos) { - len2 = 2*c->space+1 | c->space+len+1; + if (len + c->pos >= c->space) { + len2 = 2*c->space+1 | c->pos+len+1; newbuf = realloc(c->buf, len2); if (!newbuf) return 0; *c->bufp = c->buf = newbuf; |