diff options
author | djm@openbsd.org <djm@openbsd.org> | 2016-07-27 23:18:12 +0000 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2016-08-03 15:38:43 +1000 |
commit | d7e7348e72f9b203189e3fffb75605afecba4fda (patch) | |
tree | b2497e60e49d9937c3370b93b46f075ed619c003 /atomicio.c | |
parent | 5faa52d295f764562ed6dd75c4a4ce9134ae71e3 (diff) |
upstream commit
better bounds check on iovcnt (we only ever use fixed,
positive values)
Upstream-ID: 9baa6eb5cd6e30c9dc7398e5fe853721a3a5bdee
Diffstat (limited to 'atomicio.c')
-rw-r--r-- | atomicio.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/atomicio.c b/atomicio.c index b1ec234f5..f854a06f5 100644 --- a/atomicio.c +++ b/atomicio.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: atomicio.c,v 1.27 2015/01/16 06:40:12 deraadt Exp $ */ | 1 | /* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2006 Damien Miller. All rights reserved. | 3 | * Copyright (c) 2006 Damien Miller. All rights reserved. |
4 | * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. | 4 | * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. |
@@ -107,12 +107,12 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, | |||
107 | struct iovec iov_array[IOV_MAX], *iov = iov_array; | 107 | struct iovec iov_array[IOV_MAX], *iov = iov_array; |
108 | struct pollfd pfd; | 108 | struct pollfd pfd; |
109 | 109 | ||
110 | if (iovcnt > IOV_MAX) { | 110 | if (iovcnt < 0 || iovcnt > IOV_MAX) { |
111 | errno = EINVAL; | 111 | errno = EINVAL; |
112 | return 0; | 112 | return 0; |
113 | } | 113 | } |
114 | /* Make a copy of the iov array because we may modify it below */ | 114 | /* Make a copy of the iov array because we may modify it below */ |
115 | memcpy(iov, _iov, iovcnt * sizeof(*_iov)); | 115 | memcpy(iov, _iov, (size_t)iovcnt * sizeof(*_iov)); |
116 | 116 | ||
117 | #ifndef BROKEN_READV_COMPARISON | 117 | #ifndef BROKEN_READV_COMPARISON |
118 | pfd.fd = fd; | 118 | pfd.fd = fd; |