From: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
Date: Mon, 18 Jul 2011 17:37:22 +0000 (+0200)
Subject: dmesg: fix segfault
X-Git-Tag: v2.20-rc1~81
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=730d5e7761e738983e4df1e34d80fd2b06e575e6;p=thirdparty%2Futil-linux.git

dmesg: fix segfault

An element declared as size_t cannot be detected as negative (len < 0)
is always false.
This can lead to an infinite loop causing a segmentation fault.
Check if len is equal to -1 or -2 instead

Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
---

diff --git a/sys-utils/dmesg.c b/sys-utils/dmesg.c
index 867581d814..d7cf95ba0b 100644
--- a/sys-utils/dmesg.c
+++ b/sys-utils/dmesg.c
@@ -367,7 +367,7 @@ static void safe_fwrite(const char *buf, size_t size, FILE *out)
 		if (len == 0)				/* L'\0' */
 			return;
 
-		if (len < 0) {				/* invalid sequence */
+		if (len == (size_t)-1 || len == (size_t)-2) {		/* invalid sequence */
 			memset(&s, 0, sizeof (s));
 			len = hex = 1;