X-Git-Url: http://nsz.repo.hu/git/?p=musl;a=blobdiff_plain;f=src%2Fstdio%2Fopen_wmemstream.c;h=41b92d2152f58a402f5d4e965ab4e9cc8be841c2;hp=5402ca1a030acb57cd61c8fbee8a55a1115b9fda;hb=32d67e938e8da0f37c59247acee8b10eaf9a113c;hpb=1461e027579c16a6bd95a264d9a1db75a4c3fa74

diff --git a/src/stdio/open_wmemstream.c b/src/stdio/open_wmemstream.c
index 5402ca1a..41b92d21 100644
--- a/src/stdio/open_wmemstream.c
+++ b/src/stdio/open_wmemstream.c
@@ -29,7 +29,7 @@ static off_t wms_seek(FILE *f, off_t off, int whence)
 		errno = EINVAL;
 		return -1;
 	}
-	if (-off > base || off > SSIZE_MAX/4-base) goto fail;
+	if (off < -base || off > SSIZE_MAX/4-base) goto fail;
 	memset(&c->mbs, 0, sizeof c->mbs);
 	return c->pos = base+off;
 }
@@ -39,13 +39,13 @@ static size_t wms_write(FILE *f, const unsigned char *buf, size_t len)
 	struct cookie *c = f->cookie;
 	size_t len2;
 	wchar_t *newbuf;
-	if (len > c->space - c->pos) {
+	if (len >= c->space - c->pos) {
 		len2 = 2*c->space+1 | c->space+len+1;
 		if (len2 > SSIZE_MAX/4) return 0;
 		newbuf = realloc(c->buf, len2*4);
 		if (!newbuf) return 0;
 		*c->bufp = c->buf = newbuf;
-		memset(c->buf + c->space, 0, len2 - c->space);
+		memset(c->buf + c->space, 0, 4*(len2 - c->space));
 		c->space = len2;
 	}