Re: grep(1) integer overflow

[Alexander Schrijver]

> nope, only ssize_t is guaranteed. 

This is the only way i could think off.

Index: util.c
===================================================================
RCS file: /home/alex/scm/cvsync/src/usr.bin/grep/util.c,v
retrieving revision 1.41
diff -u -r1.41 util.c
--- util.c      11 Jul 2011 20:43:21 -0000      1.41
+++ util.c      17 Jul 2011 12:01:56 -0000
@@ -169,7 +169,13 @@
 {
        regmatch_t      pmatch;
        int             c, i, r;
-       int             offset;
+       regoff_t        offset;
+
+       /* size_t will be converted to regoff_t. ssize_t is guaranteed to fit
+        * into regoff_t */
+       if (l->len > SSIZE_MAX) {
+               errx(2, "Line is too big to process");
+       }
 
        c = 0;
        i = 0;
@@ -444,7 +450,7 @@
 #ifdef SMALL
        return 0;
 #else
-       int j;
+       regoff_t j;
        int rtrnVal = REG_NOMATCH;
 
        pmatch->rm_so = -1;