# Check for potential integer overflow in fread*/fwrite*.

--- glibc-2.5.orig/libio/iofread.c

+++ glibc-2.5/libio/iofread.c

@@ -40,6 +40,11 @@ _IO_fread (buf, size, count, fp)

   CHECK_FILE (fp, 0);

   if (bytes_requested == 0)

     return 0;

+#define HALF_INTERNAL_SIZE_T \

+  (((size_t) 1) << (8 * sizeof (size_t) / 2))

+  if (__builtin_expect ((count | size) >= HALF_INTERNAL_SIZE_T, 0))

+    if (bytes_requested / size != count)

+      return 0;

   _IO_acquire_lock (fp);

   bytes_read = INTUSE(_IO_sgetn) (fp, (char *) buf, bytes_requested);

   _IO_release_lock (fp);

--- glibc-2.5.orig/libio/iofread_u.c

+++ glibc-2.5/libio/iofread_u.c

@@ -42,6 +42,11 @@ fread_unlocked (buf, size, count, fp)

   CHECK_FILE (fp, 0);

   if (bytes_requested == 0)

     return 0;

+#define HALF_INTERNAL_SIZE_T \

+  (((size_t) 1) << (8 * sizeof (size_t) / 2))

+  if (__builtin_expect ((count | size) >= HALF_INTERNAL_SIZE_T, 0))

+    if (bytes_requested / size != count)

+      return 0;

   bytes_read = INTUSE(_IO_sgetn) (fp, (char *) buf, bytes_requested);

   return bytes_requested == bytes_read ? count : bytes_read / size;

 }

--- glibc-2.5.orig/libio/iofwrite.c

+++ glibc-2.5/libio/iofwrite.c

@@ -40,6 +40,11 @@ _IO_fwrite (buf, size, count, fp)

   CHECK_FILE (fp, 0);

   if (request == 0)

     return 0;

+#define HALF_INTERNAL_SIZE_T \

+  (((size_t) 1) << (8 * sizeof (size_t) / 2))

+  if (__builtin_expect ((count | size) >= HALF_INTERNAL_SIZE_T, 0))

+    if (request / size != count)

+      return 0;

   _IO_acquire_lock (fp);

   if (_IO_vtable_offset (fp) != 0 || _IO_fwide (fp, -1) == -1)

     written = _IO_sputn (fp, (const char *) buf, request);

--- glibc-2.5.orig/libio/iofwrite_u.c

+++ glibc-2.5/libio/iofwrite_u.c

@@ -42,6 +42,11 @@ fwrite_unlocked (buf, size, count, fp)

   CHECK_FILE (fp, 0);

   if (request == 0)

     return 0;

+#define HALF_INTERNAL_SIZE_T \

+  (((size_t) 1) << (8 * sizeof (size_t) / 2))

+  if (__builtin_expect ((count | size) >= HALF_INTERNAL_SIZE_T, 0))

+    if (request / size != count)

+      return 0;

   if (_IO_fwide (fp, -1) == -1)

     {

       written = _IO_sputn (fp, (const char *) buf, request);