(cat): Don't advance the write pointer past the end of the write buffer.

1 files changed, 5 insertions, 3 deletions

diff --git a/src/cat.c b/src/cat.c
index d547084ef..9845e5812 100644
--- a/src/cat.c
+++ b/src/cat.c
@@ -265,19 +265,21 @@ cat (
 	  if (outbuf + outsize <= bpout)
 	    {
 	      char *wp = outbuf;
+	      size_t remaining_bytes;
 	      do
 		{
 		  if (full_write (STDOUT_FILENO, wp, outsize) != outsize)
 		    error (EXIT_FAILURE, errno, _("write error"));
 		  wp += outsize;
+		  remaining_bytes = bpout - wp;
 		}
-	      while (wp + outsize <= bpout);
+	      while (outsize <= remaining_bytes);
 
 	      /* Move the remaining bytes to the beginning of the
 		 buffer.  */
 
-	      memmove (outbuf, wp, bpout - wp);
-	      bpout = outbuf + (bpout - wp);
+	      memmove (outbuf, wp, remaining_bytes);
+	      bpout = outbuf + remaining_bytes;
 	    }
 
 	  /* Is INBUF empty?  */