aboutsummaryrefslogtreecommitdiff
path: root/libio
diff options
context:
space:
mode:
authorJoseph Myers <joseph@codesourcery.com>2012-09-04 11:24:43 +0000
committerJoseph Myers <joseph@codesourcery.com>2012-09-04 11:24:43 +0000
commit60160d83a09c659d8d9338b210ff92be77cc87d5 (patch)
treebf83de97019d483c4081255a795f1187c5be0103 /libio
parentbcd6c8dc64e8fdd6906018ca5e8913e2f111a023 (diff)
downloadglibc-60160d83a09c659d8d9338b210ff92be77cc87d5.tar
glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.tar.gz
glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.tar.bz2
glibc-60160d83a09c659d8d9338b210ff92be77cc87d5.zip
Fix iogetdelim.c (latent) integer overflow (bug 9914).
Diffstat (limited to 'libio')
-rw-r--r--libio/iogetdelim.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/libio/iogetdelim.c b/libio/iogetdelim.c
index 405b65f1e1..bf4b0f776a 100644
--- a/libio/iogetdelim.c
+++ b/libio/iogetdelim.c
@@ -29,6 +29,7 @@
#include "libioP.h"
#include <string.h>
#include <errno.h>
+#include <limits.h>
/* Read up to (and including) a TERMINATOR from FP into *LINEPTR
(and null-terminate it). *LINEPTR is a pointer returned from malloc (or
@@ -89,7 +90,7 @@ _IO_getdelim (lineptr, n, delimiter, fp)
t = (char *) memchr ((void *) fp->_IO_read_ptr, delimiter, len);
if (t != NULL)
len = (t - fp->_IO_read_ptr) + 1;
- if (__builtin_expect (cur_len + len + 1 < 0, 0))
+ if (__builtin_expect (len >= SSIZE_MAX - cur_len, 0))
{
__set_errno (EOVERFLOW);
result = -1;