From: Rich Felker <dalias@aerifal.cx>
Date: Mon, 5 Sep 2011 01:40:42 +0000 (-0400)
Subject: fix some fmemopen behaviors
X-Git-Url: http://nsz.repo.hu/git/?p=musl;a=commitdiff_plain;h=e72ee5786b1f328da131b87388333c2e3a09b7b3;hp=a7778dae226fbae335383bc92b6cdfccc5ea9f2e

fix some fmemopen behaviors

read should not be allowed past "current size".
append mode should write at "current size", not buffer size.
null termination should not be written except when "current size" grows.
---

diff --git a/src/stdio/fmemopen.c b/src/stdio/fmemopen.c
index e2adfb22..260d2889 100644
--- a/src/stdio/fmemopen.c
+++ b/src/stdio/fmemopen.c
@@ -23,7 +23,8 @@ fail:
 static size_t mread(FILE *f, unsigned char *buf, size_t len)
 {
 	struct cookie *c = f->cookie;
-	size_t rem = c->size - c->pos;
+	size_t rem = c->len - c->pos;
+	if (c->pos > c->len) rem = 0;
 	if (len > rem) {
 		len = rem;
 		f->flags |= F_EOF;
@@ -48,13 +49,15 @@ static size_t mwrite(FILE *f, const unsigned char *buf, size_t len)
 		f->wpos = f->wbase;
 		if (mwrite(f, f->wpos, len2) < len2) return 0;
 	}
-	if (c->mode == 'a') c->pos = c->size;
+	if (c->mode == 'a') c->pos = c->len;
 	rem = c->size - c->pos;
 	if (len > rem) len = rem;
 	memcpy(c->buf+c->pos, buf, len);
 	c->pos += len;
-	if (c->pos >= c->len) c->len = c->pos;
-	c->buf[c->len==c->size ? c->len-1 : c->len] = 0;
+	if (c->pos >= c->len) {
+		c->len = c->pos;
+		c->buf[c->len==c->size ? c->len-1 : c->len] = 0;
+	}
 	return len;
 }