* src/pshint/pshalgo.c (psh_hint_overlap): Fix numeric overflow.

lemzwerg · lemzwerg · commit 13034e54aac6 · 2018-08-26T12:22:51.000+02:00
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10057
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,11 @@
+2018-08-26  Werner Lemberg  <wl@gnu.org>
+
+	* src/pshint/pshalgo.c (psh_hint_overlap): Fix numeric overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10057
+
 2018-08-26  Werner Lemberg  <wl@gnu.org>
 
 	Minor tracing adjustments.
diff --git a/src/pshinter/pshalgo.c b/src/pshinter/pshalgo.c
@@ -53,8 +53,8 @@
   psh_hint_overlap( PSH_Hint  hint1,
                     PSH_Hint  hint2 )
   {
-    return hint1->org_pos + hint1->org_len >= hint2->org_pos &&
-           hint2->org_pos + hint2->org_len >= hint1->org_pos;
+    return ADD_INT( hint1->org_pos, hint1->org_len ) >= hint2->org_pos &&
+           ADD_INT( hint2->org_pos, hint2->org_len ) >= hint1->org_pos;
   }
 
 

Original file line number	Diff line number	Diff line change
`@@ -53,8 +53,8 @@`
`53`	`53`	`psh_hint_overlap( PSH_Hint hint1,`
`54`	`54`	`PSH_Hint hint2 )`
`55`	`55`	`{`
`56`		`- return hint1->org_pos + hint1->org_len >= hint2->org_pos &&`
`57`		`- hint2->org_pos + hint2->org_len >= hint1->org_pos;`
	`56`	`+ return ADD_INT( hint1->org_pos, hint1->org_len ) >= hint2->org_pos &&`
	`57`	`+ ADD_INT( hint2->org_pos, hint2->org_len ) >= hint1->org_pos;`
`58`	`58`	`}`
`59`	`59`
`60`	`60`