00db10
commit 2d1c89a5d7c872a1109768f50e2508cf9a4b0348
00db10
Author: Florian Weimer <fweimer@redhat.com>
00db10
Date:   Wed Jun 20 09:45:19 2018 +0200
00db10
00db10
    libio: Avoid ptrdiff_t overflow in IO_validate_vtable
00db10
    
00db10
    If the candidate pointer is sufficiently far away from
00db10
    __start___libc_IO_vtables, the result might not fit into ptrdiff_t.
00db10
00db10
diff --git a/libio/libioP.h b/libio/libioP.h
00db10
index b60244ac5fc3d908..f1576381500ffc85 100644
00db10
--- a/libio/libioP.h
00db10
+++ b/libio/libioP.h
00db10
@@ -957,8 +957,8 @@ IO_validate_vtable (const struct _IO_jump_t *vtable)
00db10
   /* Fast path: The vtable pointer is within the __libc_IO_vtables
00db10
      section.  */
00db10
   uintptr_t section_length = __stop___libc_IO_vtables - __start___libc_IO_vtables;
00db10
-  const char *ptr = (const char *) vtable;
00db10
-  uintptr_t offset = ptr - __start___libc_IO_vtables;
00db10
+  uintptr_t ptr = (uintptr_t) vtable;
00db10
+  uintptr_t offset = ptr - (uintptr_t) __start___libc_IO_vtables;
00db10
   if (__glibc_unlikely (offset >= section_length))
00db10
     /* The vtable pointer is not in the expected section.  Use the
00db10
        slow path, which will terminate the process if necessary.  */