From 83375877b4b96929e9132ad10789d094de19422e Mon Sep 17 00:00:00 2001 From: tjr Date: Sun, 2 Nov 2003 23:20:24 +0000 Subject: Change the buffer length test in NEEDSP() so that it does not subtract one unsigned number from another potentially smaller one, leading to wraparound (and heap corruption, eventually). PR: 58813 MFC after: 2 weeks --- usr.bin/sed/process.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'usr.bin/sed') diff --git a/usr.bin/sed/process.c b/usr.bin/sed/process.c index d0fac86..93019b4 100644 --- a/usr.bin/sed/process.c +++ b/usr.bin/sed/process.c @@ -557,7 +557,8 @@ regsub(sp, string, src) char c, *dst; #define NEEDSP(reqlen) \ - if (sp->len >= sp->blen - (reqlen) - 1) { \ + /* XXX What is the +1 for? */ \ + if (sp->len + (reqlen) + 1 >= sp->blen) { \ sp->blen += (reqlen) + 1024; \ if ((sp->space = sp->back = realloc(sp->back, sp->blen)) \ == NULL) \ -- cgit v1.1