提交 7ee3dcb3 编写于 作者: R Rich Felker

memstreams: fix incorrect handling of file pos > current size

the addition is safe and cannot overflow because both operands are
positive when considered as signed quantities.
上级 c88f36f5
......@@ -32,8 +32,8 @@ static size_t ms_write(FILE *f, const unsigned char *buf, size_t len)
f->wpos = f->wbase;
if (ms_write(f, f->wbase, len2) < len2) return 0;
}
if (len >= c->space - c->pos) {
len2 = 2*c->space+1 | c->space+len+1;
if (len + c->pos >= c->space) {
len2 = 2*c->space+1 | c->pos+len+1;
newbuf = realloc(c->buf, len2);
if (!newbuf) return 0;
*c->bufp = c->buf = newbuf;
......
......@@ -30,8 +30,8 @@ static size_t wms_write(FILE *f, const unsigned char *buf, size_t len)
struct cookie *c = f->cookie;
size_t len2;
wchar_t *newbuf;
if (len >= c->space - c->pos) {
len2 = 2*c->space+1 | c->space+len+1;
if (len + c->pos >= c->space) {
len2 = 2*c->space+1 | c->pos+len+1;
if (len2 > SSIZE_MAX/4) return 0;
newbuf = realloc(c->buf, len2*4);
if (!newbuf) return 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册