[PATCH] Fix loops in string/strxfrm_l.c

[Denis Barbier]

Hi,

backw is of type size_t, thus loops
  for (backw = idxcnt - 1; backw >= backw_stop; --backw)
have trouble if idxcnt or backw_stop is 0.

2005-05-28  Denis Barbier  <barbier@debian.org>

	[BZ #968]
	* string/strxfrm_l.c (STRXFRM):  Fix handling of pushed
	elements.

Index: string/strxfrm_l.c
===================================================================
RCS file: /cvs/glibc/libc/string/strxfrm_l.c,v
retrieving revision 1.4
diff -u -r1.4 strxfrm_l.c
--- string/strxfrm_l.c	14 Mar 2004 20:52:47 -0000	1.4
+++ string/strxfrm_l.c	23 May 2005 22:35:59 -0000
@@ -210,18 +210,19 @@
 		      /* Handle the pushed elements now.  */
 		      size_t backw;
 
-		      for (backw = idxcnt - 1; backw >= backw_stop; --backw)
+		      /* Take care of integer overflow if backw_stop is 0.  */
+		      for (backw = idxcnt; backw > backw_stop; --backw)
 			{
-			  len = weights[idxarr[backw]++];
+			  len = weights[idxarr[backw - 1]++];
 
 			  if (needed + len < n)
 			    while (len-- > 0)
-			      dest[needed++] = weights[idxarr[backw]++];
+			      dest[needed++] = weights[idxarr[backw - 1]++];
 			  else
 			    {
 				/* No more characters fit into the buffer.  */
 			      needed += len;
-			      idxarr[backw] += len;
+			      idxarr[backw - 1] += len;
 			    }
 			}
 
@@ -293,9 +294,10 @@
 		     /* Handle the pushed elements now.  */
 		      size_t backw;
 
-		      for (backw = idxcnt - 1; backw >= backw_stop; --backw)
+		      /* Take care of integer overflow if backw_stop is 0.  */
+		      for (backw = idxcnt; backw > backw_stop; --backw)
 			{
-			  len = weights[idxarr[backw]++];
+			  len = weights[idxarr[backw - 1]++];
 			  if (len != 0)
 			    {
 #ifdef WIDE_CHAR_VERSION
@@ -304,7 +306,7 @@
 				  dest[needed] = val;
 				  for (i = 0; i < len; ++i)
 				    dest[needed + 1 + i] =
-				      weights[idxarr[backw] + i];
+				      weights[idxarr[backw - 1] + i];
 				}
 			      needed += 1 + len;
 #else
@@ -315,11 +317,11 @@
 				    dest[needed + i] = buf[i];
 				  for (i = 0; i < len; ++i)
 				    dest[needed + buflen + i] =
-				      weights[idxarr[backw] + i];
+				      weights[idxarr[backw - 1] + i];
 				}
 			      needed += buflen + len;
 #endif
-			      idxarr[backw] += len;
+			      idxarr[backw - 1] += len;
 			      val = 1;
 			    }
 			  else
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20050528/f5b22328/attachment.sig>