diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2010-12-14 11:09:32 -0800 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2010-12-14 11:10:45 -0800 |
| commit | 14ad7a25505ec3127cd1f07001d54d94f51f1748 (patch) | |
| tree | 27f044081c65cfe206b0571db0c1f7f260594a66 /src/sort.c | |
| parent | 8f40ed634c9e6696a6bf05a4924dd6f8b7c834f6 (diff) | |
| download | coreutils-14ad7a25505ec3127cd1f07001d54d94f51f1748.tar.xz | |
sort: fix very-unlikely buffer overrun when merging to input file
* src/sort.c (avoid_trashing_input): Fix a typo that could cause a
buffer overrun in theory. In practice this is extremely unlikely,
as it requires running out of file descriptors in a small merge,
presumably because some other process is hogging all the OS's file
descriptors.
Diffstat (limited to 'src/sort.c')
| -rw-r--r-- | src/sort.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/src/sort.c b/src/sort.c index 63162ea41..3321ddb6d 100644 --- a/src/sort.c +++ b/src/sort.c @@ -3613,9 +3613,8 @@ avoid_trashing_input (struct sortfile *files, size_t ntemps, files[i].name = temp; files[i].pid = pid; - if (i + num_merged < nfiles) - memmove (&files[i + 1], &files[i + num_merged], - num_merged * sizeof *files); + memmove (&files[i + 1], &files[i + num_merged], + (nfiles - (i + num_merged)) * sizeof *files); ntemps += 1; nfiles -= num_merged - 1;; i += num_merged; |