[PATCH v2] dmesg: fix segfault

[PATCH v2] dmesg: fix segfault

[Marc-Antoine Perennou]

An element declared as size_t cannot be detected as negative (len < 0)
is always false.
This can lead to an infinite loop causing a segmentation fault.
Check if len is equal to -1 or -2 instead

Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
---
 sys-utils/dmesg.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/sys-utils/dmesg.c b/sys-utils/dmesg.c
index 867581d..d7cf95b 100644
--- a/sys-utils/dmesg.c
+++ b/sys-utils/dmesg.c
@@ -367,7 +367,7 @@ static void safe_fwrite(const char *buf, size_t
size, FILE *out)
 		if (len == 0)				/* L'\0' */
 			return;

-		if (len < 0) {				/* invalid sequence */
+		if (len == (size_t)-1 || len == (size_t)-2) {		/* invalid sequence */
 			memset(&s, 0, sizeof (s));
 			len = hex = 1;

-- 
1.7.6.134.gcf13f6.dirty

Re: [PATCH v2] dmesg: fix segfault

[Karel Zak]

On Mon, Jul 18, 2011 at 07:37:22PM +0200, Marc-Antoine Perennou wrote:
> An element declared as size_t cannot be detected as negative (len < 0)
> is always false.
> This can lead to an infinite loop causing a segmentation fault.
> Check if len is equal to -1 or -2 instead
> 
> Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
> ---
>  sys-utils/dmesg.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)

 Applied, thanks.

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com