diff options
| author | Monty <xiphmont@xiph.org> | 2010-06-04 06:01:33 +0000 |
|---|---|---|
| committer | Monty <xiphmont@xiph.org> | 2010-06-04 06:01:33 +0000 |
| commit | 67133192afc14bdb97518840579baad722c9c304 (patch) | |
| tree | b88eb7342a8ba6c8be5a02912e742724c1bcb35f /src | |
| parent | e64842ca0c77b39fafc4522ba5c22618ab9e01c4 (diff) | |
| download | ogg-git-67133192afc14bdb97518840579baad722c9c304.tar.gz | |
Two cleanups of buffer LONG_MAX overflow hardening:
GCC optimizes out the overflow check due to the overflow check reyling on overflow;
reimplement using type-based TYPE_MAX macro
Correct an accidental assignment-during-check that wasn't a bug, but was
semantically incorrect and rightly triggered a compilation warning.
svn path=/trunk/ogg/; revision=17270
Diffstat (limited to 'src')
| -rw-r--r-- | src/bitwise.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/bitwise.c b/src/bitwise.c index 48b7192..7a57f55 100644 --- a/src/bitwise.c +++ b/src/bitwise.c @@ -84,7 +84,7 @@ void oggpack_write(oggpack_buffer *b,unsigned long value,int bits){ if(b->endbyte>=b->storage-4){ void *ret; if(!b->ptr)return; - if(b->storage+BUFFER_INCREMENT<b->storage) goto err; + if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err; ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT); if(!ret) goto err; b->buffer=ret; @@ -127,7 +127,7 @@ void oggpackB_write(oggpack_buffer *b,unsigned long value,int bits){ if(b->endbyte>=b->storage-4){ void *ret; if(!b->ptr)return; - if(b->storage+BUFFER_INCREMENT<b->storage) goto err; + if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err; ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT); if(!ret) goto err; b->buffer=ret; @@ -198,7 +198,7 @@ static void oggpack_writecopy_helper(oggpack_buffer *b, if(b->endbyte+bytes+1>=b->storage){ void *ret; if(!b->ptr) goto err; - if(b->storage=b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err; + if(b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err; b->storage=b->endbyte+bytes+BUFFER_INCREMENT; ret=_ogg_realloc(b->buffer,b->storage); if(!ret) goto err; |