(cat): Don't advance the write pointer past the end of the write buffer.

diff --git a/src/cat.c b/src/cat.c
index d547084efa3565efa378b996082d40c937586aec..9845e58124dad46bff2a851613354b9995f85459 100644 (file)
--- a/src/cat.c
+++ b/src/cat.c
@@ -265,19 +265,21 @@ cat (
          if (outbuf + outsize <= bpout)
            {
              char *wp = outbuf;
+             size_t remaining_bytes;
              do
                {
                  if (full_write (STDOUT_FILENO, wp, outsize) != outsize)
                    error (EXIT_FAILURE, errno, _("write error"));
                  wp += outsize;
+                 remaining_bytes = bpout - wp;
                }
-             while (wp + outsize <= bpout);
+             while (outsize <= remaining_bytes);
 
              /* Move the remaining bytes to the beginning of the
                 buffer.  */
 
-             memmove (outbuf, wp, bpout - wp);
-             bpout = outbuf + (bpout - wp);
+             memmove (outbuf, wp, remaining_bytes);
+             bpout = outbuf + remaining_bytes;
            }
 
          /* Is INBUF empty?  */