* termcap.c: Don't assume sizes fit in int and never overflow.

(struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
(gobble_line): Check for size-calculation overflow.

diff --git a/src/ChangeLog b/src/ChangeLog
index 238e37a43a1b0087bf951245cfb8f45d248b1b40..21daa1c8e3bf81459ff7fd3f6aea08ce4a4229fc 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,9 @@
 2011-06-20  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * termcap.c: Don't assume sizes fit in int and never overflow.
+       (struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
+       (gobble_line): Check for size-calculation overflow.
+
        * minibuf.c (Fread_buffer):
        * lread.c (intern, intern_c_string):
        * image.c (xpm_scan) [HAVE_NS && !HAVE_XPM]:

diff --git a/src/termcap.c b/src/termcap.c
index 5b71ad229d7e6166dd6eb1caf5423dce72fa9c71..e191f6b3af372b07806515a13c06fbb9061c717b 100644 (file)
--- a/src/termcap.c
+++ b/src/termcap.c
@@ -323,10 +323,10 @@ tputs (register const char *str, int nlines, int (*outfun) (int))
 struct termcap_buffer
   {
     char *beg;
-    int size;
+    ptrdiff_t size;
     char *ptr;
     int ateof;
-    int full;
+    ptrdiff_t full;
   };
 
 /* Forward declarations of static functions.  */
@@ -367,7 +367,7 @@ tgetent (char *bp, const char *name)
   register char *bp1;
   char *tc_search_point;
   char *term;
-  int malloc_size = 0;
+  ptrdiff_t malloc_size = 0;
   register int c;
   char *tcenv = NULL;          /* TERMCAP value, if it contains :tc=.  */
   char *indirect = NULL;       /* Terminal type in :tc= in TERMCAP value.  */
@@ -637,6 +637,8 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
        {
          if (bufp->full == bufp->size)
            {
+             if ((PTRDIFF_MAX - 1) / 2 < bufp->size)
+               memory_full (SIZE_MAX);
              bufp->size *= 2;
              /* Add 1 to size to ensure room for terminating null.  */
              tem = (char *) xrealloc (buf, bufp->size + 1);
@@ -715,4 +717,3 @@ tprint (cap)
 }
 
 #endif /* TEST */
-