summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2009-04-08 19:08:34 +0200
committerStefan Metzmacher <metze@samba.org>2009-04-10 19:38:29 +0200
commitf20f5ae8e6b9ca5c90441a3083f6904168388fdf (patch)
tree75f263fb54fd198c8b142afedaea3bbc4e90f1ea /lib
parentbc5cd077643bc73d93fa73970761f8d1708d14a9 (diff)
downloadsamba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.tar.gz
samba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.tar.bz2
samba-f20f5ae8e6b9ca5c90441a3083f6904168388fdf.zip
socket_wrapper: fix crash bug in swrap_readv/writev
metze
Diffstat (limited to 'lib')
-rw-r--r--lib/socket_wrapper/socket_wrapper.c14
1 files changed, 10 insertions, 4 deletions
diff --git a/lib/socket_wrapper/socket_wrapper.c b/lib/socket_wrapper/socket_wrapper.c
index 553827b192..d3853de50d 100644
--- a/lib/socket_wrapper/socket_wrapper.c
+++ b/lib/socket_wrapper/socket_wrapper.c
@@ -2101,6 +2101,7 @@ int swrap_readv(int s, const struct iovec *vector, size_t count)
uint8_t *buf;
off_t ofs = 0;
size_t i;
+ size_t remain = ret;
/* we capture it as one single packet */
buf = (uint8_t *)malloc(ret);
@@ -2111,10 +2112,12 @@ int swrap_readv(int s, const struct iovec *vector, size_t count)
}
for (i=0; i < count; i++) {
+ size_t this_time = MIN(remain, vector[i].iov_len);
memcpy(buf + ofs,
vector[i].iov_base,
- vector[i].iov_len);
- ofs += vector[i].iov_len;
+ this_time);
+ ofs += this_time;
+ remain -= this_time;
}
swrap_dump_packet(si, NULL, SWRAP_RECV, buf, ret);
@@ -2161,6 +2164,7 @@ int swrap_writev(int s, const struct iovec *vector, size_t count)
uint8_t *buf;
off_t ofs = 0;
size_t i;
+ size_t remain = ret;
/* we capture it as one single packet */
buf = (uint8_t *)malloc(ret);
@@ -2171,10 +2175,12 @@ int swrap_writev(int s, const struct iovec *vector, size_t count)
}
for (i=0; i < count; i++) {
+ size_t this_time = MIN(remain, vector[i].iov_len);
memcpy(buf + ofs,
vector[i].iov_base,
- vector[i].iov_len);
- ofs += vector[i].iov_len;
+ this_time);
+ ofs += this_time;
+ remain -= this_time;
}
swrap_dump_packet(si, NULL, SWRAP_SEND, buf, ret);