From 32d67e938e8da0f37c59247acee8b10eaf9a113c Mon Sep 17 00:00:00 2001 From: Rich Felker Date: Sun, 4 Sep 2011 00:06:01 -0400 Subject: fix twos complement overflow bug in mem streams boundary check the expression -off is not safe in case off is the most-negative value. instead apply - to base which is known to be non-negative and bounded within sanity. --- src/stdio/open_wmemstream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/stdio/open_wmemstream.c') diff --git a/src/stdio/open_wmemstream.c b/src/stdio/open_wmemstream.c index 3bc0f254..41b92d21 100644 --- a/src/stdio/open_wmemstream.c +++ b/src/stdio/open_wmemstream.c @@ -29,7 +29,7 @@ static off_t wms_seek(FILE *f, off_t off, int whence) errno = EINVAL; return -1; } - if (-off > base || off > SSIZE_MAX/4-base) goto fail; + if (off < -base || off > SSIZE_MAX/4-base) goto fail; memset(&c->mbs, 0, sizeof c->mbs); return c->pos = base+off; } -- cgit v1.2.1