rlines() checks:

1) really check for size overflow by checking negative value.
2) since mmap() not support files over INT_MAX size, add check for it
until either mmap() will be fixed or tail will be rewritted to handle
large files alternatively.
3) replace fseek(... file_size, SEEK_SET) with fseek(... 0L, SEEK_END)
to avoid off_t -> long cast
4) Use exit() if file is too big instead of warning and wrong logic
afterwards.

1 files changed, 10 insertions, 3 deletions

diff --git a/usr.bin/tail/forward.c b/usr.bin/tail/forward.c
index e25e0d6..f63b410 100644
--- a/usr.bin/tail/forward.c
+++ b/usr.bin/tail/forward.c
@@ -274,10 +274,17 @@ rlines(fp, off, sbp)
 	if (!(size = sbp->st_size))
 		return;
 
-	if (size > SIZE_T_MAX) {
+	if (size > SIZE_T_MAX || size < 0) {
 		errno = EFBIG;
 		ierr();
-		return;
+		exit(1);
+	}
+
+	/* XXX: FIXME - mmap() not support files over 2Gb */
+	if (size > INT_MAX) {
+		errno = EFBIG;
+		ierr();
+		exit(1);
 	}
 
 	if ((start = mmap(NULL, (size_t)size,
@@ -296,7 +303,7 @@ rlines(fp, off, sbp)
 	/* Set the file pointer to reflect the length displayed. */
 	size = sbp->st_size - size;
 	WR(p, size);
-	if (fseek(fp, (long)sbp->st_size, SEEK_SET) == -1) {
+	if (fseek(fp, 0L, SEEK_END) == -1) {
 		ierr();
 		return;
 	}