From 5ff3eea91fa6bdce25b3a35644433f68e076beca Mon Sep 17 00:00:00 2001 From: Rich Felker Date: Fri, 7 Oct 2022 19:37:56 -0400 Subject: fgets: avoid arithmetic overflow when n==INT_MIN is passed performing n-- is not a safe operation for arbitrary signed input n. only perform the decrement in the code path where the initial n is greater than 1, and adjust the condition in the n<=1 code path to compensate for it not having been decremented. --- src/stdio/fgets.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/stdio/fgets.c b/src/stdio/fgets.c index 6171f398..4a100b39 100644 --- a/src/stdio/fgets.c +++ b/src/stdio/fgets.c @@ -12,13 +12,14 @@ char *fgets(char *restrict s, int n, FILE *restrict f) FLOCK(f); - if (n--<=1) { + if (n<=1) { f->mode |= f->mode-1; FUNLOCK(f); - if (n) return 0; + if (n<1) return 0; *s = 0; return s; } + n--; while (n) { if (f->rpos != f->rend) { -- cgit v1.2.1