diff options
| author | Alan Jenkins <alan-jenkins@tuffmail.co.uk> | 2009-05-28 17:59:06 +0100 |
|---|---|---|
| committer | Kay Sievers <kay.sievers@vrfy.org> | 2009-05-28 19:19:42 +0200 |
| commit | 542aeeb48ab002c6136885f99aa23870f8ffa25b (patch) | |
| tree | 60fd3be181fc8c8122253948bd6b2681ba4cbc67 /udev | |
| parent | a29b30b4115db16035998c551117685d8152a496 (diff) | |
udevd: queue-export - fix crash
The math in skip_to() was the wrong way round and allocated a
variable size array on the stack with a massively negative size.
Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Diffstat (limited to 'udev')
| -rw-r--r-- | udev/lib/libudev-queue-export.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/udev/lib/libudev-queue-export.c b/udev/lib/libudev-queue-export.c index ddb1974dbe..a36ff5150a 100644 --- a/udev/lib/libudev-queue-export.c +++ b/udev/lib/libudev-queue-export.c @@ -115,8 +115,8 @@ static int skip_to(FILE *file, long offset) /* fseek may drop buffered data, avoid it for small seeks */ old_offset = ftell(file); - if (offset > old_offset && old_offset - offset <= BUFSIZ) { - size_t skip_bytes = old_offset - offset; + if (offset > old_offset && offset - old_offset <= BUFSIZ) { + size_t skip_bytes = offset - old_offset; char buf[skip_bytes]; if (fread(buf, skip_bytes, 1, file) != skip_bytes) |