diff options
| author | Stefan Metzmacher <metze@samba.org> | 2009-04-08 19:08:34 +0200 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2009-04-10 19:38:29 +0200 |
| commit | f20f5ae8e6b9ca5c90441a3083f6904168388fdf (patch) | |
| tree | 75f263fb54fd198c8b142afedaea3bbc4e90f1ea /lib | |
| parent | bc5cd077643bc73d93fa73970761f8d1708d14a9 (diff) | |
| download | samba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.tar.gz samba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.tar.bz2 samba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.zip | |
socket_wrapper: fix crash bug in swrap_readv/writev
metze
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/socket_wrapper/socket_wrapper.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/lib/socket_wrapper/socket_wrapper.c b/lib/socket_wrapper/socket_wrapper.c index 553827b192..d3853de50d 100644 --- a/lib/socket_wrapper/socket_wrapper.c +++ b/lib/socket_wrapper/socket_wrapper.c @@ -2101,6 +2101,7 @@ int swrap_readv(int s, const struct iovec *vector, size_t count) uint8_t *buf; off_t ofs = 0; size_t i; + size_t remain = ret; /* we capture it as one single packet */ buf = (uint8_t *)malloc(ret); @@ -2111,10 +2112,12 @@ int swrap_readv(int s, const struct iovec *vector, size_t count) } for (i=0; i < count; i++) { + size_t this_time = MIN(remain, vector[i].iov_len); memcpy(buf + ofs, vector[i].iov_base, - vector[i].iov_len); - ofs += vector[i].iov_len; + this_time); + ofs += this_time; + remain -= this_time; } swrap_dump_packet(si, NULL, SWRAP_RECV, buf, ret); @@ -2161,6 +2164,7 @@ int swrap_writev(int s, const struct iovec *vector, size_t count) uint8_t *buf; off_t ofs = 0; size_t i; + size_t remain = ret; /* we capture it as one single packet */ buf = (uint8_t *)malloc(ret); @@ -2171,10 +2175,12 @@ int swrap_writev(int s, const struct iovec *vector, size_t count) } for (i=0; i < count; i++) { + size_t this_time = MIN(remain, vector[i].iov_len); memcpy(buf + ofs, vector[i].iov_base, - vector[i].iov_len); - ofs += vector[i].iov_len; + this_time); + ofs += this_time; + remain -= this_time; } swrap_dump_packet(si, NULL, SWRAP_SEND, buf, ret); |