X-Git-Url: https://git.saurik.com/apple/libc.git/blobdiff_plain/1f2f436a38f7ae2d39a943ad2898d8fed4ed2e58..refs/heads/master:/stdio/FreeBSD/getdelim.c

diff --git a/stdio/FreeBSD/getdelim.c b/stdio/FreeBSD/getdelim.c
index 8faa92d..705231a 100644
--- a/stdio/FreeBSD/getdelim.c
+++ b/stdio/FreeBSD/getdelim.c
@@ -28,6 +28,7 @@
 __FBSDID("$FreeBSD: src/lib/libc/stdio/getdelim.c,v 1.3 2009/10/04 19:43:36 das Exp $");
 
 #include "namespace.h"
+#include <os/overflow.h>
 #include <sys/param.h>
 #include <errno.h>
 #include <limits.h>
@@ -96,9 +97,16 @@ static int
 sappend(char ** __restrict dstp, size_t * __restrict dstlenp,
 	size_t * __restrict dstcapp, char * __restrict src, size_t srclen)
 {
+	size_t tmp;
+
+	/* avoid overflowing the result length */
+	if (os_add3_overflow(srclen, *dstlenp, 1, &tmp)) {
+		errno = EOVERFLOW;
+		return (-1);
+	}
 
 	/* ensure room for srclen + dstlen + terminating NUL */
-	if (expandtofit(dstp, srclen + *dstlenp + 1, dstcapp))
+	if (expandtofit(dstp, tmp, dstcapp))
 		return (-1);
 	memcpy(*dstp + *dstlenp, src, srclen);
 	*dstlenp += srclen;
@@ -134,7 +142,7 @@ getdelim(char ** __restrict linep, size_t * __restrict linecapp, int delim,
 
 	linelen = 0;
 	while ((endp = memchr(fp->_p, delim, fp->_r)) == NULL) {
-		if (sappend(linep, &linelen, linecapp, fp->_p, fp->_r))
+		if (sappend(linep, &linelen, linecapp, (char*)fp->_p, fp->_r))
 			goto error;
 		if (__srefill(fp)) {
 			if (__sferror(fp))
@@ -143,7 +151,7 @@ getdelim(char ** __restrict linep, size_t * __restrict linecapp, int delim,
 		}
 	}
 	endp++;	/* snarf the delimiter, too */
-	if (sappend(linep, &linelen, linecapp, fp->_p, endp - fp->_p))
+	if (sappend(linep, &linelen, linecapp, (char*)fp->_p, endp - fp->_p))
 		goto error;
 	fp->_r -= endp - fp->_p;
 	fp->_p = endp;