mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-20 22:48:22 +00:00
The potential overflow issue arises at "size += ret;" because "size" is of type ssize_t (signed) while "len" is size_t (unsigned). Repeatedly adding read sizes, "ret", to "size" can potentially exceed the maximum value of ssize_t, causing it to overflow into a negative or incorrect value. The fix is to ensure "len" is within the range of SSIZE_MAX. Fixes: CID 473850 Fixes: CID 473863 Signed-off-by: Lidong Chen <lidong.chen@oracle.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>