diff options
author | cheloha <> | 2021-12-02 20:58:01 +0000 |
---|---|---|
committer | cheloha <> | 2021-12-02 20:58:01 +0000 |
commit | bd634dd15594b3e9c78eb50c254cc44a25b8cba5 (patch) | |
tree | 191e970e7b56e3251dc8e76dc81ab926e791f089 | |
parent | b5d39b69357a51c124fee3d534973a83056efa7b (diff) | |
download | openbsd-bd634dd15594b3e9c78eb50c254cc44a25b8cba5.tar.gz openbsd-bd634dd15594b3e9c78eb50c254cc44a25b8cba5.tar.bz2 openbsd-bd634dd15594b3e9c78eb50c254cc44a25b8cba5.zip |
bsearch(3): support arrays with more than INT_MAX elements
The "lim" variable needs to be a size_t to match nmemb, otherwise we
get undefined behavior when nmemb exceeds INT_MAX.
Prompted by a blog post by Joshua Bloch:
https://ai.googleblog.com/2006/06/extra-extra-read-all-about-it-nearly.html
Fixed by Chris Torek a long time ago:
https://svnweb.freebsd.org/csrg/lib/libc/stdlib/bsearch.c?revision=51742&view=markup
ok millert@
-rw-r--r-- | src/lib/libc/stdlib/bsearch.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/libc/stdlib/bsearch.c b/src/lib/libc/stdlib/bsearch.c index 59d478e7eb..6df44d6b4f 100644 --- a/src/lib/libc/stdlib/bsearch.c +++ b/src/lib/libc/stdlib/bsearch.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: bsearch.c,v 1.8 2016/10/22 19:19:34 tb Exp $ */ | 1 | /* $OpenBSD: bsearch.c,v 1.9 2021/12/02 20:58:01 cheloha Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 1990 Regents of the University of California. | 3 | * Copyright (c) 1990 Regents of the University of California. |
4 | * All rights reserved. | 4 | * All rights reserved. |
@@ -51,8 +51,9 @@ bsearch(const void *key, const void *base0, size_t nmemb, size_t size, | |||
51 | int (*compar)(const void *, const void *)) | 51 | int (*compar)(const void *, const void *)) |
52 | { | 52 | { |
53 | const char *base = base0; | 53 | const char *base = base0; |
54 | int lim, cmp; | ||
55 | const void *p; | 54 | const void *p; |
55 | size_t lim; | ||
56 | int cmp; | ||
56 | 57 | ||
57 | for (lim = nmemb; lim != 0; lim >>= 1) { | 58 | for (lim = nmemb; lim != 0; lim >>= 1) { |
58 | p = base + (lim >> 1) * size; | 59 | p = base + (lim >> 1) * size; |