Module Name: src
Committed By: joerg
Date: Fri Dec 11 21:22:57 UTC 2015
Modified Files:
src/lib/libform: field.c
Log Message:
Counting from 0 to n-1 can go wrong badly, if n is unsigned and zero and
the counter variable is not of a type larger than n. Fixes PR 50490.
To generate a diff of this commit:
cvs rdiff -u -r1.29 -r1.30 src/lib/libform/field.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libform/field.c
diff -u src/lib/libform/field.c:1.29 src/lib/libform/field.c:1.30
--- src/lib/libform/field.c:1.29 Mon Sep 7 15:50:49 2015
+++ src/lib/libform/field.c Fri Dec 11 21:22:57 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: field.c,v 1.29 2015/09/07 15:50:49 joerg Exp $ */
+/* $NetBSD: field.c,v 1.30 2015/12/11 21:22:57 joerg Exp $ */
/*-
* Copyright (c) 1998-1999 Brett Lymn
* ([email protected], [email protected])
@@ -29,7 +29,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: field.c,v 1.29 2015/09/07 15:50:49 joerg Exp $");
+__RCSID("$NetBSD: field.c,v 1.30 2015/12/11 21:22:57 joerg Exp $");
#include <sys/param.h>
#include <stdlib.h>
@@ -900,7 +900,7 @@ int
free_field(FIELD *field)
{
FIELD *flink;
- int i;
+ unsigned int i;
_formi_tab_t *ts, *nts;
if (field == NULL)
@@ -913,7 +913,7 @@ free_field(FIELD *field)
/* no it is not - release the buffers */
free(field->buffers);
/* free the tab structures */
- for (i = 0; i < field->row_count - 1; i++) {
+ for (i = 0; i + 1 < field->row_count; i++) {
if (field->alines[i].tabs != NULL) {
ts = field->alines[i].tabs;
while (ts != NULL) {
