From: Rich Felker <dalias@aerifal.cx>
Date: Sun, 4 Sep 2011 00:19:51 +0000 (-0400)
Subject: fix some length calculations in memory streams
X-Git-Url: http://nsz.repo.hu/git/?p=musl;a=commitdiff_plain;h=1e6937643577e1fb5ea8696c2f583e20bcd29279

fix some length calculations in memory streams
---

diff --git a/src/stdio/open_memstream.c b/src/stdio/open_memstream.c
index dedc3d51..2f3569f1 100644
--- a/src/stdio/open_memstream.c
+++ b/src/stdio/open_memstream.c
@@ -41,7 +41,7 @@ static size_t ms_write(FILE *f, const unsigned char *buf, size_t len)
 		f->wpos = f->wbase;
 		if (ms_write(f, f->wbase, len2) < len2) return 0;
 	}
-	if (len > c->space - c->pos) {
+	if (len >= c->space - c->pos) {
 		len2 = 2*c->space+1 | c->space+len+1;
 		newbuf = realloc(c->buf, len2);
 		if (!newbuf) return 0;
diff --git a/src/stdio/open_wmemstream.c b/src/stdio/open_wmemstream.c
index 5402ca1a..3bc0f254 100644
--- a/src/stdio/open_wmemstream.c
+++ b/src/stdio/open_wmemstream.c
@@ -39,13 +39,13 @@ static size_t wms_write(FILE *f, const unsigned char *buf, size_t len)
 	struct cookie *c = f->cookie;
 	size_t len2;
 	wchar_t *newbuf;
-	if (len > c->space - c->pos) {
+	if (len >= c->space - c->pos) {
 		len2 = 2*c->space+1 | c->space+len+1;
 		if (len2 > SSIZE_MAX/4) return 0;
 		newbuf = realloc(c->buf, len2*4);
 		if (!newbuf) return 0;
 		*c->bufp = c->buf = newbuf;
-		memset(c->buf + c->space, 0, len2 - c->space);
+		memset(c->buf + c->space, 0, 4*(len2 - c->space));
 		c->space = len2;
 	}