vis

commit 65371e43c4e6f075b00a91dd62a1b96a595324b3
parent 0717c327b9a05e736dfaeab0cee700637782ade7
Author: Marc André Tanner <mat@brain-dump.org>
Date:   Mon, 20 Feb 2017 13:45:38 +0100

buffer: fix integer overflow issue

Diffstat:
M
buffer.c
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/buffer.c b/buffer.c
@@ -65,9 +65,10 @@ bool buffer_put0(Buffer *buf, const char *data) {
 }
 
 bool buffer_remove(Buffer *buf, size_t pos, size_t len) {
+	size_t end;
 	if (len == 0)
 		return true;
-	if (pos + len > buf->len)
+	if (!addu(pos, len, &end) || end > buf->len)
 		return false;
 	memmove(buf->data + pos, buf->data + pos + len, buf->len - pos - len);
 	buf->len -= len;