diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2011-07-28 18:24:19 -0700 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2011-07-28 18:24:19 -0700 |
| commit | 0d8f2df7c41d8904df693e4046849751adebd8ab (patch) | |
| tree | f9fc8f8113006216c1056214cfca2a5548161fa8 /src/termcap.c | |
| parent | fee31f82d5279a6faeb2d4cef808e9d7fce2f210 (diff) | |
| download | emacs-0d8f2df7c41d8904df693e4046849751adebd8ab.tar.gz | |
* termcap.c: Integer and memory overflow issues.
(tgetent): Use ptrdiff_t, not int, to record results of
subtracting pointers.
(gobble_line): Check for overflow more carefully. Don't update size
until alloc done.
Diffstat (limited to 'src/termcap.c')
| -rw-r--r-- | src/termcap.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/src/termcap.c b/src/termcap.c index 96b9303d62d..791c593c06f 100644 --- a/src/termcap.c +++ b/src/termcap.c @@ -480,7 +480,7 @@ tgetent (char *bp, const char *name) /* If BP is malloc'd by us, make sure it is big enough. */ if (malloc_size) { - int offset1 = bp1 - bp, offset2 = tc_search_point - bp; + ptrdiff_t offset1 = bp1 - bp, offset2 = tc_search_point - bp; malloc_size = offset1 + buf.size; bp = termcap_name = (char *) xrealloc (bp, malloc_size); bp1 = termcap_name + offset1; @@ -619,7 +619,6 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end) register char *end; register int nread; register char *buf = bufp->beg; - register char *tem; if (!append_end) append_end = bufp->ptr; @@ -636,14 +635,17 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end) { if (bufp->full == bufp->size) { - if ((PTRDIFF_MAX - 1) / 2 < bufp->size) + ptrdiff_t ptr_offset = bufp->ptr - buf; + ptrdiff_t append_end_offset = append_end - buf; + ptrdiff_t size; + if ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / 2 < bufp->size) memory_full (SIZE_MAX); - bufp->size *= 2; + size = 2 * bufp->size; /* Add 1 to size to ensure room for terminating null. */ - tem = (char *) xrealloc (buf, bufp->size + 1); - bufp->ptr = (bufp->ptr - buf) + tem; - append_end = (append_end - buf) + tem; - bufp->beg = buf = tem; + bufp->beg = buf = (char *) xrealloc (buf, size + 1); + bufp->size = size; + bufp->ptr = buf + ptr_offset; + append_end = buf + append_end_offset; } } else |