diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2011-06-20 00:21:06 -0700 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2011-06-20 00:21:06 -0700 |
| commit | 171e2a582e4c7d6bfd6d6ff0373720b59568bcb2 (patch) | |
| tree | 4f890becce238ad2856f519f72d647831fef1888 /src/termcap.c | |
| parent | ad39facaee4dcbd0e3f002e0a1674fce00e92c0c (diff) | |
| download | emacs-171e2a582e4c7d6bfd6d6ff0373720b59568bcb2.tar.gz emacs-171e2a582e4c7d6bfd6d6ff0373720b59568bcb2.tar.bz2 emacs-171e2a582e4c7d6bfd6d6ff0373720b59568bcb2.zip | |
* termcap.c: Don't assume sizes fit in int and never overflow.
(struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
(gobble_line): Check for size-calculation overflow.
Diffstat (limited to 'src/termcap.c')
| -rw-r--r-- | src/termcap.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/termcap.c b/src/termcap.c index 5b71ad229d7..e191f6b3af3 100644 --- a/src/termcap.c +++ b/src/termcap.c @@ -323,10 +323,10 @@ tputs (register const char *str, int nlines, int (*outfun) (int)) struct termcap_buffer { char *beg; - int size; + ptrdiff_t size; char *ptr; int ateof; - int full; + ptrdiff_t full; }; /* Forward declarations of static functions. */ @@ -367,7 +367,7 @@ tgetent (char *bp, const char *name) register char *bp1; char *tc_search_point; char *term; - int malloc_size = 0; + ptrdiff_t malloc_size = 0; register int c; char *tcenv = NULL; /* TERMCAP value, if it contains :tc=. */ char *indirect = NULL; /* Terminal type in :tc= in TERMCAP value. */ @@ -637,6 +637,8 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end) { if (bufp->full == bufp->size) { + if ((PTRDIFF_MAX - 1) / 2 < bufp->size) + memory_full (SIZE_MAX); bufp->size *= 2; /* Add 1 to size to ensure room for terminating null. */ tem = (char *) xrealloc (buf, bufp->size + 1); @@ -715,4 +717,3 @@ tprint (cap) } #endif /* TEST */ - |