From db4536763e2d0f691d53ef7aef2dc45fbece3a86 Mon Sep 17 00:00:00 2001 From: ache Date: Tue, 3 Nov 2015 17:27:24 +0000 Subject: [PATCH] Check for (old|new)size + 1 overflows off_t. PR: 204230 MFC after: 1 week --- usr.bin/bsdiff/bsdiff/bsdiff.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usr.bin/bsdiff/bsdiff/bsdiff.c b/usr.bin/bsdiff/bsdiff/bsdiff.c index db0bf69e238c..7e39275a0a46 100644 --- a/usr.bin/bsdiff/bsdiff/bsdiff.c +++ b/usr.bin/bsdiff/bsdiff/bsdiff.c @@ -237,7 +237,8 @@ int main(int argc,char *argv[]) err(1, "%s", argv[1]); if (oldsize > SSIZE_MAX || - (uintmax_t)oldsize >= SIZE_T_MAX / sizeof(off_t)) { + (uintmax_t)oldsize >= SIZE_T_MAX / sizeof(off_t) || + oldsize == OFF_MAX) { errno = EFBIG; err(1, "%s", argv[1]); } @@ -260,7 +261,8 @@ int main(int argc,char *argv[]) ((newsize=lseek(fd,0,SEEK_END))==-1)) err(1, "%s", argv[2]); - if (newsize > SSIZE_MAX || (uintmax_t)newsize >= SIZE_T_MAX) { + if (newsize > SSIZE_MAX || (uintmax_t)newsize >= SIZE_T_MAX || + newsize == OFF_MAX) { errno = EFBIG; err(1, "%s", argv[2]); }