projects
/
musl
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
d8f35e2
)
fgets: avoid arithmetic overflow when n==INT_MIN is passed
author
Rich Felker
<dalias@aerifal.cx>
Fri, 7 Oct 2022 23:37:56 +0000
(19:37 -0400)
committer
Rich Felker
<dalias@aerifal.cx>
Wed, 19 Oct 2022 18:01:32 +0000
(14:01 -0400)
performing n-- is not a safe operation for arbitrary signed input n.
only perform the decrement in the code path where the initial n is
greater than 1, and adjust the condition in the n<=1 code path to
compensate for it not having been decremented.
src/stdio/fgets.c
patch
|
blob
|
history
diff --git
a/src/stdio/fgets.c
b/src/stdio/fgets.c
index
6171f39
..
4a100b3
100644
(file)
--- a/
src/stdio/fgets.c
+++ b/
src/stdio/fgets.c
@@
-12,13
+12,14
@@
char *fgets(char *restrict s, int n, FILE *restrict f)
FLOCK(f);
FLOCK(f);
- if (n
--
<=1) {
+ if (n<=1) {
f->mode |= f->mode-1;
FUNLOCK(f);
f->mode |= f->mode-1;
FUNLOCK(f);
- if (n) return 0;
+ if (n
<1
) return 0;
*s = 0;
return s;
}
*s = 0;
return s;
}
+ n--;
while (n) {
if (f->rpos != f->rend) {
while (n) {
if (f->rpos != f->rend) {