d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Change the buffer length test in NEEDSP() so that it does not

Browse Source 
subtract one unsigned number from another potentially smaller
one, leading to wraparound (and heap corruption, eventually).

PR:		58813
MFC after:	2 weeks
This commit is contained in:
Tim J. Robbins 2003-11-02 23:20:24 +00:00
parent 5758d949d5
commit ce20a8e9be
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=121915
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr.bin/sed/process.c
View File

@ -557,7 +557,8 @@ regsub(sp, string, src)
char c, *dst;
#define NEEDSP(reqlen) \
if (sp->len >= sp->blen - (reqlen) - 1) { \
/* XXX What is the +1 for? */ \
if (sp->len + (reqlen) + 1 >= sp->blen) { \
sp->blen += (reqlen) + 1024; \
if ((sp->space = sp->back = realloc(sp->back, sp->blen)) \
== NULL) \