1 files changed, 23 insertions, 3 deletions

diff --git a/libbb/fgets_str.c b/libbb/fgets_str.c
index 8026a15da..3fe61cdc3 100644
--- a/libbb/fgets_str.c
+++ b/libbb/fgets_str.c
@@ -10,7 +10,7 @@
 
 #include "libbb.h"
 
-static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string, int chop_off)
+static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string, int chop_off, size_t *maxsz_p)
 {
 	char *linebuf = NULL;
 	const int term_length = strlen(terminating_string);
@@ -18,6 +18,7 @@ static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string,
 	int linebufsz = 0;
 	int idx = 0;
 	int ch;
+	size_t maxsz = *maxsz_p;
 
 	while (1) {
 		ch = fgetc(file);
@@ -30,6 +31,11 @@ static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string,
 		if (idx >= linebufsz) {
 			linebufsz += 200;
 			linebuf = xrealloc(linebuf, linebufsz);
+			if (idx >= maxsz) {
+				linebuf[idx] = ch;
+				idx++;
+				break;
+			}
 		}
 
 		linebuf[idx] = ch;
@@ -48,6 +54,7 @@ static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string,
 	/* Grow/shrink *first*, then store NUL */
 	linebuf = xrealloc(linebuf, idx + 1);
 	linebuf[idx] = '\0';
+	*maxsz_p = idx;
 	return linebuf;
 }
 
@@ -57,10 +64,23 @@ static char *xmalloc_fgets_internal(FILE *file, const char *terminating_string,
  * Return NULL if EOF is reached immediately.  */
 char* FAST_FUNC xmalloc_fgets_str(FILE *file, const char *terminating_string)
 {
-	return xmalloc_fgets_internal(file, terminating_string, 0);
+	size_t maxsz = INT_MAX - 4095;
+	return xmalloc_fgets_internal(file, terminating_string, 0, &maxsz);
+}
+
+char* FAST_FUNC xmalloc_fgets_str_len(FILE *file, const char *terminating_string, size_t *maxsz_p)
+{
+	size_t maxsz;
+
+	if (!maxsz_p) {
+		maxsz = INT_MAX - 4095;
+		maxsz_p = &maxsz;
+	}
+	return xmalloc_fgets_internal(file, terminating_string, 0, maxsz_p);
 }
 
 char* FAST_FUNC xmalloc_fgetline_str(FILE *file, const char *terminating_string)
 {
-	return xmalloc_fgets_internal(file, terminating_string, 1);
+	size_t maxsz = INT_MAX - 4095;
+	return xmalloc_fgets_internal(file, terminating_string, 1, &maxsz);
 }