prevent CNAME/PTR parsing from reading data past the response end

[musl] / src / stdio / setvbuf.c

diff --git a/src/stdio/setvbuf.c b/src/stdio/setvbuf.c
index 0a0c139..523dddc 100644 (file)
--- a/src/stdio/setvbuf.c
+++ b/src/stdio/setvbuf.c
@@ -1,7 +1,7 @@
 #include "stdio_impl.h"
 
 /* The behavior of this function is undefined except when it is the first
- * operation on the stream, so the presence or absence of lockign is not
+ * operation on the stream, so the presence or absence of locking is not
  * observable in a program whose behavior is defined. Thus no locking is
  * performed here. No allocation of buffers is performed, but a buffer
  * provided by the caller is used as long as it is suitably sized. */
@@ -12,13 +12,15 @@ int setvbuf(FILE *restrict f, char *restrict buf, int type, size_t size)
 
        if (type == _IONBF) {
                f->buf_size = 0;
-       } else {
+       } else if (type == _IOLBF || type == _IOFBF) {
                if (buf && size >= UNGET) {
-                       f->buf = (void *)buf;
+                       f->buf = (void *)(buf + UNGET);
                        f->buf_size = size - UNGET;
                }
                if (type == _IOLBF && f->buf_size)
                        f->lbf = '\n';
+       } else {
+               return -1;
        }
 
        f->flags |= F_SVB;