diff options
| author | Monty <xiphmont@xiph.org> | 2010-06-04 06:01:33 +0000 |
|---|---|---|
| committer | Monty <xiphmont@xiph.org> | 2010-06-04 06:01:33 +0000 |
| commit | 4cc55ae6b7cea5cdc8bafaf1b81a854c3b514926 (patch) | |
| tree | b88eb7342a8ba6c8be5a02912e742724c1bcb35f /src | |
| parent | df3d17c58bd8127227ddc881050554e2711ca81f (diff) | |
| download | ogg-4cc55ae6b7cea5cdc8bafaf1b81a854c3b514926.tar.gz | |
Two cleanups of buffer LONG_MAX overflow hardening:
GCC optimizes out the overflow check due to the overflow check reyling on overflow;
reimplement using type-based TYPE_MAX macro
Correct an accidental assignment-during-check that wasn't a bug, but was
semantically incorrect and rightly triggered a compilation warning.
git-svn-id: http://svn.xiph.org/trunk/ogg@17270 0101bb08-14d6-0310-b084-bc0e0c8e3800
Diffstat (limited to 'src')
| -rw-r--r-- | src/bitwise.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/bitwise.c b/src/bitwise.c index 48b7192..7a57f55 100644 --- a/src/bitwise.c +++ b/src/bitwise.c @@ -84,7 +84,7 @@ void oggpack_write(oggpack_buffer *b,unsigned long value,int bits){ if(b->endbyte>=b->storage-4){ void *ret; if(!b->ptr)return; - if(b->storage+BUFFER_INCREMENT<b->storage) goto err; + if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err; ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT); if(!ret) goto err; b->buffer=ret; @@ -127,7 +127,7 @@ void oggpackB_write(oggpack_buffer *b,unsigned long value,int bits){ if(b->endbyte>=b->storage-4){ void *ret; if(!b->ptr)return; - if(b->storage+BUFFER_INCREMENT<b->storage) goto err; + if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err; ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT); if(!ret) goto err; b->buffer=ret; @@ -198,7 +198,7 @@ static void oggpack_writecopy_helper(oggpack_buffer *b, if(b->endbyte+bytes+1>=b->storage){ void *ret; if(!b->ptr) goto err; - if(b->storage=b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err; + if(b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err; b->storage=b->endbyte+bytes+BUFFER_INCREMENT; ret=_ogg_realloc(b->buffer,b->storage); if(!ret) goto err; |