aboutsummaryrefslogtreecommitdiff
path: root/libio
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2005-01-06 02:09:15 +0000
committerUlrich Drepper <drepper@redhat.com>2005-01-06 02:09:15 +0000
commit1b99d99f0e7e7bfc690f260d16193f162dfda8cf (patch)
tree9300dc0bf62d3c96812d67ee54c943b9af82b0f2 /libio
parent1e7cceb99ec29742d8d07abfaa39718b3aed65a1 (diff)
downloadglibc-1b99d99f0e7e7bfc690f260d16193f162dfda8cf.tar
glibc-1b99d99f0e7e7bfc690f260d16193f162dfda8cf.tar.gz
glibc-1b99d99f0e7e7bfc690f260d16193f162dfda8cf.tar.bz2
glibc-1b99d99f0e7e7bfc690f260d16193f162dfda8cf.zip
Update.
* libio/fmemopen.c (fmemopen_seek): SEEK_END should count from maximum used address, not maximum buffer position.
Diffstat (limited to 'libio')
-rw-r--r--libio/fmemopen.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index 265b848ebe..51e849e846 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -164,7 +164,7 @@ fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
break;
case SEEK_END:
- np = c->size - *p;
+ np = c->maxpos - *p;
break;
default:
@@ -201,6 +201,13 @@ fmemopen (void *buf, size_t len, const char *mode)
cookie_io_functions_t iof;
fmemopen_cookie_t *c;
+ if (len == 0)
+ {
+ einval:
+ __set_errno (EINVAL);
+ return NULL;
+ }
+
c = (fmemopen_cookie_t *) malloc (sizeof (fmemopen_cookie_t));
if (c == NULL)
return NULL;
@@ -218,7 +225,12 @@ fmemopen (void *buf, size_t len, const char *mode)
c->buffer[0] = '\0';
}
else
- c->buffer = buf;
+ {
+ if ((uintptr_t) len > -(uintptr_t) buf)
+ goto einval;
+
+ c->buffer = buf;
+ }
c->size = len;