From: Rich Felker <dalias@aerifal.cx>
Date: Fri, 7 Oct 2022 23:37:56 +0000 (-0400)
Subject: fgets: avoid arithmetic overflow when n==INT_MIN is passed
X-Git-Url: http://nsz.repo.hu/git/?a=commitdiff_plain;h=5ff3eea91fa6bdce25b3a35644433f68e076beca;hp=d8f35e29d0e35a90f44c04de585470c211afddf9;p=musl

fgets: avoid arithmetic overflow when n==INT_MIN is passed

performing n-- is not a safe operation for arbitrary signed input n.
only perform the decrement in the code path where the initial n is
greater than 1, and adjust the condition in the n<=1 code path to
compensate for it not having been decremented.
---

diff --git a/src/stdio/fgets.c b/src/stdio/fgets.c
index 6171f398..4a100b39 100644
--- a/src/stdio/fgets.c
+++ b/src/stdio/fgets.c
@@ -12,13 +12,14 @@ char *fgets(char *restrict s, int n, FILE *restrict f)
 
 	FLOCK(f);
 
-	if (n--<=1) {
+	if (n<=1) {
 		f->mode |= f->mode-1;
 		FUNLOCK(f);
-		if (n) return 0;
+		if (n<1) return 0;
 		*s = 0;
 		return s;
 	}
+	n--;
 
 	while (n) {
 		if (f->rpos != f->rend) {