1 files changed, 22 insertions, 21 deletions

diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index 23b5c5fea8..319dba83cb 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -1,5 +1,5 @@
 /* fmemopen implementation.
-   Copyright (C) 2015-2016 Free Software Foundation, Inc.
+   Copyright (C) 2015-2018 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -22,7 +22,6 @@
 
 
 #include <errno.h>
-#include <libio.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>
@@ -38,7 +37,7 @@ struct fmemopen_cookie_struct
   int         mybuffer;  /* allocated my buffer?  */
   int         append;    /* buffer open for append?  */
   size_t      size;      /* buffer length in bytes.  */
-  _IO_off64_t pos;       /* current position at the buffer.  */
+  off64_t     pos;       /* current position at the buffer.  */
   size_t      maxpos;    /* max position in buffer.  */
 };
 
@@ -50,16 +49,14 @@ fmemopen_read (void *cookie, char *b, size_t s)
 
   if (c->pos + s > c->maxpos)
     {
-      if ((size_t) c->pos == c->maxpos)
-	return 0;
-      s = c->size - c->pos;
+      s = c->maxpos - c->pos;
+      if ((size_t) c->pos > c->maxpos)
+	s = 0;
     }
 
   memcpy (b, &(c->buffer[c->pos]), s);
 
   c->pos += s;
-  if ((size_t) c->pos > c->maxpos)
-    c->maxpos = c->pos;
 
   return s;
 }
@@ -69,29 +66,30 @@ static ssize_t
 fmemopen_write (void *cookie, const char *b, size_t s)
 {
   fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;;
-  _IO_off64_t pos = c->append ? c->maxpos : c->pos;
-  int addnullc;
-
-  addnullc = (s == 0 || b[s - 1] != '\0');
+  off64_t pos = c->append ? c->maxpos : c->pos;
+  int addnullc = (s == 0 || b[s - 1] != '\0');
 
-  if (pos + s + addnullc > c->size)
+  if (pos + s > c->size)
     {
       if ((size_t) (c->pos + addnullc) >= c->size)
 	{
 	  __set_errno (ENOSPC);
 	  return 0;
 	}
-      s = c->size - pos - addnullc;
+      s = c->size - pos;
     }
 
   memcpy (&(c->buffer[pos]), b, s);
 
-  pos += s;
-  if ((size_t) pos > c->maxpos)
+  c->pos = pos + s;
+  if ((size_t) c->pos > c->maxpos)
     {
-      c->maxpos = pos;
-      if (addnullc)
+      c->maxpos = c->pos;
+      if (c->maxpos < c->size && addnullc)
 	c->buffer[c->maxpos] = '\0';
+      /* A null byte is written in a stream open for update iff it fits.  */
+      else if (c->append == 0 && addnullc != 0)
+	c->buffer[c->size-1] = '\0';
     }
 
   return s;
@@ -99,9 +97,9 @@ fmemopen_write (void *cookie, const char *b, size_t s)
 
 
 static int
-fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
+fmemopen_seek (void *cookie, off64_t *p, int w)
 {
-  _IO_off64_t np;
+  off64_t np;
   fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;
 
   switch (w)
@@ -123,7 +121,10 @@ fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
     }
 
   if (np < 0 || (size_t) np > c->size)
-    return -1;
+    {
+      __set_errno (EINVAL);
+      return -1;
+    }
 
   *p = c->pos = np;