Commit 171e2a58 authored by Paul Eggert's avatar Paul Eggert

* termcap.c: Don't assume sizes fit in int and never overflow.

(struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
(gobble_line): Check for size-calculation overflow.
parent ad39faca
2011-06-20 Paul Eggert <eggert@cs.ucla.edu>
* termcap.c: Don't assume sizes fit in int and never overflow.
(struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
(gobble_line): Check for size-calculation overflow.
* minibuf.c (Fread_buffer):
* lread.c (intern, intern_c_string):
* image.c (xpm_scan) [HAVE_NS && !HAVE_XPM]:
......
......@@ -323,10 +323,10 @@ tputs (register const char *str, int nlines, int (*outfun) (int))
struct termcap_buffer
{
char *beg;
int size;
ptrdiff_t size;
char *ptr;
int ateof;
int full;
ptrdiff_t full;
};
/* Forward declarations of static functions. */
......@@ -367,7 +367,7 @@ tgetent (char *bp, const char *name)
register char *bp1;
char *tc_search_point;
char *term;
int malloc_size = 0;
ptrdiff_t malloc_size = 0;
register int c;
char *tcenv = NULL; /* TERMCAP value, if it contains :tc=. */
char *indirect = NULL; /* Terminal type in :tc= in TERMCAP value. */
......@@ -637,6 +637,8 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
{
if (bufp->full == bufp->size)
{
if ((PTRDIFF_MAX - 1) / 2 < bufp->size)
memory_full (SIZE_MAX);
bufp->size *= 2;
/* Add 1 to size to ensure room for terminating null. */
tem = (char *) xrealloc (buf, bufp->size + 1);
......@@ -715,4 +717,3 @@ tprint (cap)
}
#endif /* TEST */
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment