diff options
| author |   ray <ray@openbsd.org> | 2007-01-30 03:57:29 +0000 |
|---|---|---|
| committer | ray <ray@openbsd.org> | 2007-01-30 03:57:29 +0000 |
| commit | 94eaa7ec40997c8135dff468abe35e59b6367e3d (patch) | |
| tree | e781f04fdc03374723257b8571529157f622d2fb /lib/libc/stdio/vfprintf.c | |
| parent | Allow the bnx(4) driver to make use of all of the available hardware (diff) | |
| download | wireguard-openbsd-94eaa7ec40997c8135dff468abe35e59b6367e3d.tar.xz wireguard-openbsd-94eaa7ec40997c8135dff468abe35e59b6367e3d.zip | |
Remove and simplify an impossible case (if *p = memchr(cp, 0, prec),
p - cp cannot be greater than prec).
Prevent an integer overflow when printing a string with length
greater than INT_MAX.
Initial diff from millert@.
OK millert@, beck@, and otto@.
Diffstat (limited to 'lib/libc/stdio/vfprintf.c')
| -rw-r--r-- | lib/libc/stdio/vfprintf.c | 16 |
1 files changed, 7 insertions, 9 deletions
diff --git a/lib/libc/stdio/vfprintf.c b/lib/libc/stdio/vfprintf.c index f88ee8d04a7..74200d32e89 100644 --- a/lib/libc/stdio/vfprintf.c +++ b/lib/libc/stdio/vfprintf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: vfprintf.c,v 1.41 2007/01/16 19:20:53 millert Exp $ */ +/* $OpenBSD: vfprintf.c,v 1.42 2007/01/30 03:57:29 ray Exp $ */ /*- * Copyright (c) 1990 The Regents of the University of California. * All rights reserved. @@ -605,15 +605,13 @@ reswitch: switch (ch) { */ char *p = memchr(cp, 0, prec); - if (p != NULL) { - size = p - cp; - if (size > prec) - size = prec; - } else { - size = prec; - } + size = p ? (p - cp) : prec; } else { - size = strlen(cp); + size_t len; + + if ((len = strlen(cp)) > INT_MAX) + goto overflow; + size = (int)len; } sign = '\0'; break; |