Hi Folks,
This patch adds in the needed checks which I left out when fixing
pr31501. It is straight forward and I will commit this evening with the
test case in the PR.
Regression tested on x86-64.
Jerry
2007-12-25 Jerry DeLisle <jvdelisle@gcc.gnu.org>
* io/transfer.c (read_sf): Check if readlen was less than the requested
number of bytes to read and if so, generate error.
Index: transfer.c
===================================================================
--- transfer.c (revision 131155)
+++ transfer.c (working copy)
@@ -166,7 +166,14 @@ read_sf (st_parameter_dt *dtp, int *leng
{
readlen = *length;
q = salloc_r (dtp->u.p.current_unit->s, &readlen);
- memcpy (p, q, readlen);
+ if (readlen < *length)
+ {
+ generate_error (&dtp->common, LIBERROR_END, NULL);
+ return NULL;
+ }
+
+ if (q != NULL)
+ memcpy (p, q, readlen);
goto done;
}