[PATCH] queue-export: fix crash

[PATCH] queue-export: fix crash

[Alan Jenkins]

The math in skip_to() was the wrong way round and allocated a
variable size array on the stack with a massively negative size.

Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
---
 udev/lib/libudev-queue-export.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/udev/lib/libudev-queue-export.c b/udev/lib/libudev-queue-export.c
index ddb1974..a36ff51 100644
--- a/udev/lib/libudev-queue-export.c
+++ b/udev/lib/libudev-queue-export.c
@@ -115,8 +115,8 @@ static int skip_to(FILE *file, long offset)
 
 	/* fseek may drop buffered data, avoid it for small seeks */
 	old_offset = ftell(file);
-	if (offset > old_offset && old_offset - offset <= BUFSIZ) {
-		size_t skip_bytes = old_offset - offset;
+	if (offset > old_offset && offset - old_offset <= BUFSIZ) {
+		size_t skip_bytes = offset - old_offset;
 		char buf[skip_bytes];
 
 		if (fread(buf, skip_bytes, 1, file) != skip_bytes)
-- 
1.5.4.3

Re: [PATCH] queue-export: fix crash

[Kay Sievers]

On Thu, May 28, 2009 at 18:59, Alan Jenkins <alan-jenkins@tuffmail.co.uk> wrote:
> The math in skip_to() was the wrong way round and allocated a
> variable size array on the stack with a massively negative size.

Applied.

Thanks,
Kay