From b1686d1b22aa95a17088f99054d577bbb2aef9dc Mon Sep 17 00:00:00 2001
From: Stacey Ell <stacey.ell@gmail.com>
Date: Wed, 27 May 2015 08:48:19 -0600
Subject: [PATCH] fix(buffer): check capacity before resizing

``cmp::min(cap * 4, MAX_BUFFER_SIZE) - cap'' can underflow when
cap > MAX_BUFFER_SIZE.  cap can exceed MAX_BUFFER_SIZE because
Vec::reserve aligns to powers of two.

Discovered by Matt Howard <themdhoward@gmail.com>
---
 src/buffer.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/buffer.rs b/src/buffer.rs
index f2f1714a8b..1168e2475e 100644
--- a/src/buffer.rs
+++ b/src/buffer.rs
@@ -67,7 +67,7 @@ impl<R: Read> BufReader<R> {
     #[inline]
     fn maybe_reserve(&mut self) {
         let cap = self.buf.capacity();
-        if self.cap == cap {
+        if self.cap == cap && cap < MAX_BUFFER_SIZE {
             self.buf.reserve(cmp::min(cap * 4, MAX_BUFFER_SIZE) - cap);
             let new = self.buf.capacity() - self.buf.len();
             trace!("reserved {}", new);