This is the mail archive of the libc-alpha@sources.redhat.com mailing list for the glibc project.
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |
Other format: | [Raw text] |
Hi, backw is of type size_t, thus loops for (backw = idxcnt - 1; backw >= backw_stop; --backw) have trouble if idxcnt or backw_stop is 0. 2005-05-28 Denis Barbier <barbier@debian.org> [BZ #968] * string/strxfrm_l.c (STRXFRM): Fix handling of pushed elements. Index: string/strxfrm_l.c =================================================================== RCS file: /cvs/glibc/libc/string/strxfrm_l.c,v retrieving revision 1.4 diff -u -r1.4 strxfrm_l.c --- string/strxfrm_l.c 14 Mar 2004 20:52:47 -0000 1.4 +++ string/strxfrm_l.c 23 May 2005 22:35:59 -0000 @@ -210,18 +210,19 @@ /* Handle the pushed elements now. */ size_t backw; - for (backw = idxcnt - 1; backw >= backw_stop; --backw) + /* Take care of integer overflow if backw_stop is 0. */ + for (backw = idxcnt; backw > backw_stop; --backw) { - len = weights[idxarr[backw]++]; + len = weights[idxarr[backw - 1]++]; if (needed + len < n) while (len-- > 0) - dest[needed++] = weights[idxarr[backw]++]; + dest[needed++] = weights[idxarr[backw - 1]++]; else { /* No more characters fit into the buffer. */ needed += len; - idxarr[backw] += len; + idxarr[backw - 1] += len; } } @@ -293,9 +294,10 @@ /* Handle the pushed elements now. */ size_t backw; - for (backw = idxcnt - 1; backw >= backw_stop; --backw) + /* Take care of integer overflow if backw_stop is 0. */ + for (backw = idxcnt; backw > backw_stop; --backw) { - len = weights[idxarr[backw]++]; + len = weights[idxarr[backw - 1]++]; if (len != 0) { #ifdef WIDE_CHAR_VERSION @@ -304,7 +306,7 @@ dest[needed] = val; for (i = 0; i < len; ++i) dest[needed + 1 + i] = - weights[idxarr[backw] + i]; + weights[idxarr[backw - 1] + i]; } needed += 1 + len; #else @@ -315,11 +317,11 @@ dest[needed + i] = buf[i]; for (i = 0; i < len; ++i) dest[needed + buflen + i] = - weights[idxarr[backw] + i]; + weights[idxarr[backw - 1] + i]; } needed += buflen + len; #endif - idxarr[backw] += len; + idxarr[backw - 1] += len; val = 1; } else
Attachment:
signature.asc
Description: Digital signature
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |