[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: security-related gcc bug

On Tue, 8 Apr 2008, Hallvard B Furuseth wrote:
Howard Chu writes:
You just test:
	if ( in->bv_len > MYSIZE || in->bv_len + len > MYSIZE )
		return FAIL;

Except that in->bv_len + len can wrap around:-) In this case, use if ( in->bv_len > MYSIZE - len ) since len will be <= MYSIZE.

No, you don't know whether len is <= MYSIZE, but you _do_ know that in->bv_len is less than MYSIZE from the first clause in the test. So:
if ( in->bv_len > MYSIZE || len > MYSIZE - in->bv_len )
return FAIL;

Philip Guenther