Ver Fonte

fix overflows in uint comparisons

Oswald Buddenhagen há 5 anos atrás
pai
commit
bee4fc54e7
2 ficheiros alterados com 6 adições e 3 exclusões
  1. 2 2
      src/drv_maildir.c
  2. 4 1
      src/util.c

+ 2 - 2
src/drv_maildir.c

@@ -840,8 +840,8 @@ maildir_compare( const void *l, const void *r )
 	char *ldot, *rdot, *ldot2, *rdot2, *lseq, *rseq;
 	int ret, llen, rlen;
 
-	if ((ret = lm->uid - rm->uid))
-		return ret;
+	if (lm->uid != rm->uid)  // Can't subtract, the result might not fit into signed int.
+		return lm->uid > rm->uid ? 1 : -1;
 
 	/* No UID, so sort by arrival date. We should not do this, but we rely
 	   on the suggested unique file name scheme - we have no choice. */

+ 4 - 1
src/util.c

@@ -534,7 +534,10 @@ map_name( const char *arg, char **result, int reserve, const char *in, const cha
 static int
 compare_uints( const void *l, const void *r )
 {
-	return *(uint *)l - *(uint *)r;
+	uint li = *(uint *)l, ri = *(uint *)r;
+	if (li != ri)  // Can't subtract, the result might not fit into signed int.
+		return li > ri ? 1 : -1;
+	return 0;
 }
 
 void