Skip to content

Commit aea3d3d

Browse files
committed
Fixed positive seek bounds checking
This bug was a result of an annoying corner case around intermingling signed and unsigned offsets. The boundary check that prevents seeking a file to a position before the file was preventing valid seeks with positive offsets. This corner case is a bit more complicated than it looks because the offset is signed, while the size of the file is unsigned. Simply casting both to signed or unsigned offsets won't handle large files.
1 parent be22d34 commit aea3d3d

File tree

2 files changed

+18
-2
lines changed

2 files changed

+18
-2
lines changed

lfs.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1635,13 +1635,13 @@ lfs_soff_t lfs_file_seek(lfs_t *lfs, lfs_file_t *file,
16351635
if (whence == LFS_SEEK_SET) {
16361636
file->pos = off;
16371637
} else if (whence == LFS_SEEK_CUR) {
1638-
if ((lfs_off_t)-off > file->pos) {
1638+
if (off < 0 && (lfs_off_t)-off > file->pos) {
16391639
return LFS_ERR_INVAL;
16401640
}
16411641

16421642
file->pos = file->pos + off;
16431643
} else if (whence == LFS_SEEK_END) {
1644-
if ((lfs_off_t)-off > file->size) {
1644+
if (off < 0 && (lfs_off_t)-off > file->size) {
16451645
return LFS_ERR_INVAL;
16461646
}
16471647

tests/test_seek.sh

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,14 @@ tests/test.py << TEST
133133
lfs_file_read(&lfs, &file[0], buffer, size) => size;
134134
memcmp(buffer, "kittycatcat", size) => 0;
135135
136+
lfs_file_seek(&lfs, &file[0], 0, LFS_SEEK_CUR) => size;
137+
lfs_file_read(&lfs, &file[0], buffer, size) => size;
138+
memcmp(buffer, "kittycatcat", size) => 0;
139+
140+
lfs_file_seek(&lfs, &file[0], size, LFS_SEEK_CUR) => 3*size;
141+
lfs_file_read(&lfs, &file[0], buffer, size) => size;
142+
memcmp(buffer, "kittycatcat", size) => 0;
143+
136144
lfs_file_seek(&lfs, &file[0], pos, LFS_SEEK_SET) => pos;
137145
lfs_file_read(&lfs, &file[0], buffer, size) => size;
138146
memcmp(buffer, "kittycatcat", size) => 0;
@@ -174,6 +182,14 @@ tests/test.py << TEST
174182
lfs_file_read(&lfs, &file[0], buffer, size) => size;
175183
memcmp(buffer, "kittycatcat", size) => 0;
176184
185+
lfs_file_seek(&lfs, &file[0], 0, LFS_SEEK_CUR) => size;
186+
lfs_file_read(&lfs, &file[0], buffer, size) => size;
187+
memcmp(buffer, "kittycatcat", size) => 0;
188+
189+
lfs_file_seek(&lfs, &file[0], size, LFS_SEEK_CUR) => 3*size;
190+
lfs_file_read(&lfs, &file[0], buffer, size) => size;
191+
memcmp(buffer, "kittycatcat", size) => 0;
192+
177193
lfs_file_seek(&lfs, &file[0], pos, LFS_SEEK_SET) => pos;
178194
lfs_file_read(&lfs, &file[0], buffer, size) => size;
179195
memcmp(buffer, "kittycatcat", size) => 0;

0 commit comments

Comments
 (0)