@@ -68,7 +68,8 @@ static int unpack_buggy(const unsigned char *blob, unsigned int blob_size,
6868 size_t * out_copy_len )
6969{
7070 unsigned int blob_offset = 3 ; /* skip 3-byte header */
71- unsigned int name_len , value_len ;
71+ unsigned int name_len ;
72+ unsigned int value_len ;
7273
7374 if (blob_offset + 1 >= blob_size ) return -1 ;
7475 name_len = (blob [blob_offset ] << 8 ) + blob [blob_offset + 1 ];
@@ -100,7 +101,7 @@ static int unpack_buggy(const unsigned char *blob, unsigned int blob_size,
100101 * with var->value_len declared `unsigned int`. If value_len == 0,
101102 * `value_len - 1` wraps to UINT_MAX. Reproduce that arithmetic
102103 * verbatim so the sanitizers see exactly the same operation. */
103- size_t copy_len = (size_t )(unsigned int )( value_len - 1 );
104+ size_t copy_len = (size_t )(value_len - 1 );
104105 if (out_copy_len ) * out_copy_len = copy_len ;
105106 return 1 ;
106107}
@@ -109,7 +110,8 @@ static int unpack_patched(const unsigned char *blob, unsigned int blob_size,
109110 size_t * out_copy_len )
110111{
111112 unsigned int blob_offset = 3 ;
112- unsigned int name_len , value_len ;
113+ unsigned int name_len ;
114+ unsigned int value_len ;
113115
114116 if (blob_offset + 1 >= blob_size ) return -1 ;
115117 name_len = (blob [blob_offset ] << 8 ) + blob [blob_offset + 1 ];
@@ -129,7 +131,7 @@ static int unpack_patched(const unsigned char *blob, unsigned int blob_size,
129131 /* === patched bound check on value (the fix from 4f33f5b) ============= */
130132 if (value_len < 1 || blob_offset + value_len > blob_size ) return 0 ;
131133
132- size_t copy_len = (size_t )(unsigned int )( value_len - 1 );
134+ size_t copy_len = (size_t )(value_len - 1 );
133135 if (out_copy_len ) * out_copy_len = copy_len ;
134136 return 1 ;
135137}
@@ -229,7 +231,8 @@ static const size_t n_cases = sizeof(cases) / sizeof(cases[0]);
229231
230232static int run_one (const struct case_t * c )
231233{
232- size_t buggy_copy = 0 , patched_copy = 0 ;
234+ size_t buggy_copy = 0 ;
235+ size_t patched_copy = 0 ;
233236 int buggy_rc = unpack_buggy (c -> blob , c -> blob_size , & buggy_copy );
234237 int patched_rc = unpack_patched (c -> blob , c -> blob_size , & patched_copy );
235238
@@ -274,7 +277,7 @@ int main(void)
274277 * even on the buggy code. Force a runtime assert. */
275278 {
276279 unsigned int v = 0 ;
277- size_t got = (size_t )(unsigned int )( v - 1 );
280+ size_t got = (size_t )(v - 1 );
278281 if (got != (size_t )UINT_MAX ) {
279282 fprintf (stderr ,
280283 "FATAL: this platform's unsigned int wrap is %zu,"
0 commit comments