From 4cc55ae6b7cea5cdc8bafaf1b81a854c3b514926 Mon Sep 17 00:00:00 2001
From: Monty <xiphmont@xiph.org>
Date: Fri, 4 Jun 2010 06:01:33 +0000
Subject: Two cleanups of buffer LONG_MAX overflow hardening:

GCC optimizes out the overflow check due to the overflow check reyling on overflow;
reimplement using type-based TYPE_MAX macro

Correct an accidental assignment-during-check that wasn't a bug, but was
semantically incorrect and rightly triggered a compilation warning.



git-svn-id: http://svn.xiph.org/trunk/ogg@17270 0101bb08-14d6-0310-b084-bc0e0c8e3800
---
 src/bitwise.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/bitwise.c b/src/bitwise.c
index 48b7192..7a57f55 100644
--- a/src/bitwise.c
+++ b/src/bitwise.c
@@ -84,7 +84,7 @@ void oggpack_write(oggpack_buffer *b,unsigned long value,int bits){
   if(b->endbyte>=b->storage-4){
     void *ret;
     if(!b->ptr)return;
-    if(b->storage+BUFFER_INCREMENT<b->storage) goto err;
+    if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err;
     ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT);
     if(!ret) goto err;
     b->buffer=ret;
@@ -127,7 +127,7 @@ void oggpackB_write(oggpack_buffer *b,unsigned long value,int bits){
   if(b->endbyte>=b->storage-4){
     void *ret;
     if(!b->ptr)return;
-    if(b->storage+BUFFER_INCREMENT<b->storage) goto err;
+    if(b->storage>TYPE_MAX(b->storage)-BUFFER_INCREMENT) goto err;
     ret=_ogg_realloc(b->buffer,b->storage+BUFFER_INCREMENT);
     if(!ret) goto err;
     b->buffer=ret;
@@ -198,7 +198,7 @@ static void oggpack_writecopy_helper(oggpack_buffer *b,
     if(b->endbyte+bytes+1>=b->storage){
       void *ret;
       if(!b->ptr) goto err;
-      if(b->storage=b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err;
+      if(b->endbyte+bytes+BUFFER_INCREMENT>b->storage) goto err;
       b->storage=b->endbyte+bytes+BUFFER_INCREMENT;
       ret=_ogg_realloc(b->buffer,b->storage);
       if(!ret) goto err;
-- 
cgit v1.2.1