[src/trunk]: src/lib/libform Counting from 0 to n-1 can go wrong badly, if n ...

[joerg <joerg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/79465fe7126f
branches:  trunk
changeset: 342194:79465fe7126f
user:      joerg <joerg%NetBSD.org@localhost>
date:      Fri Dec 11 21:22:57 2015 +0000

description:
Counting from 0 to n-1 can go wrong badly, if n is unsigned and zero and
the counter variable is not of a type larger than n. Fixes PR 50490.

diffstat:

 lib/libform/field.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 919e4ad5f2e0 -r 79465fe7126f lib/libform/field.c
--- a/lib/libform/field.c       Fri Dec 11 21:05:18 2015 +0000
+++ b/lib/libform/field.c       Fri Dec 11 21:22:57 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: field.c,v 1.29 2015/09/07 15:50:49 joerg Exp $ */
+/*     $NetBSD: field.c,v 1.30 2015/12/11 21:22:57 joerg Exp $ */
 /*-
  * Copyright (c) 1998-1999 Brett Lymn
  *                         (blymn%baea.com.au@localhost, brett_lymn%yahoo.com.au@localhost)
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: field.c,v 1.29 2015/09/07 15:50:49 joerg Exp $");
+__RCSID("$NetBSD: field.c,v 1.30 2015/12/11 21:22:57 joerg Exp $");
 
 #include <sys/param.h>
 #include <stdlib.h>
@@ -900,7 +900,7 @@
 free_field(FIELD *field)
 {
        FIELD *flink;
-       int i;
+       unsigned int i;
        _formi_tab_t *ts, *nts;
        
        if (field == NULL)
@@ -913,7 +913,7 @@
                  /* no it is not - release the buffers */
                free(field->buffers);
                  /* free the tab structures */
-               for (i = 0; i < field->row_count - 1; i++) {
+               for (i = 0; i + 1 < field->row_count; i++) {
                        if (field->alines[i].tabs != NULL) {
                                ts = field->alines[i].tabs;
                                while (ts != NULL) {