search

sudo-project / sudo

Utility to execute a command as another user
https://www.sudo.ws
Other
1.16k stars 208 forks source link

nbytes should be compared against INT_MAX, not UINT_MAX #262

Closed RSilicon closed 1 year ago

RSilicon commented 1 year ago

This is because nbytes is passed as an integer to gzgets, a function in zlib.

RSilicon commented 1 year ago

Yes there is no reason for this to be the case in zlib, but that is the signature

millert commented 1 year ago

I think it is better to just match fgets and gzgets by making the size argument an int which is what I have done in 2f4b406.

RSilicon commented 1 year ago

Note: I am going to see if I can patch zlib to take an unsigned value as the implemention of gzgets has no reason not to.

But, I figure we should do this first just in case that gets shot down.

millert commented 1 year ago

I doubt the zlib authors will be interested in a a break ABI change like that, especially since fgets() uses int for the size parameter too.