[patch] Fix BZ 19165 -- overflow in fread / fwrite

[Mike Frysinger]

On 26 Oct 2015 19:04, Paul Pluzhnikov wrote:
> --- a/libio/libioP.h
> +++ b/libio/libioP.h
> +
> +/* Returns a*b if the result doesn't overflow, else SIZE_MAX.  */
> +static inline size_t
> +__attribute__ ((__always_inline__))

__always_inline

> +_IO_saturating_umull (size_t a, size_t b)
> +{
> +#if __GNUC_PREREQ(5, 0)

needs space before the (

> +  size_t result;
> +
> +  if (__builtin_umull_overflow (a, b, &result)) {
> +    return SIZE_MAX;
> +  }

braces are wrong -- just delete them

> +  return result;

seems like it'd be better:
  return __builtin_umull_overflow (a, b, &result) ? SIZE_MAX : result;

> +#else
> +  const size_t mul_no_overflow = (size_t) 1 << 4 * sizeof (size_t);
> +  if ((a >= mul_no_overflow || b >= mul_no_overflow)
> +      && b > 1 && a > SIZE_MAX / b)

should we add a __umull_overflow define to misc/sys/cdefs.h ?
then we don't have to duplicate this logic everywhere.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20151027/6306a49c/attachment.sig>