From d7e7348e72f9b203189e3fffb75605afecba4fda Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Wed, 27 Jul 2016 23:18:12 +0000 Subject: upstream commit better bounds check on iovcnt (we only ever use fixed, positive values) Upstream-ID: 9baa6eb5cd6e30c9dc7398e5fe853721a3a5bdee --- atomicio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'atomicio.c') diff --git a/atomicio.c b/atomicio.c index b1ec234f5..f854a06f5 100644 --- a/atomicio.c +++ b/atomicio.c @@ -1,4 +1,4 @@ -/* $OpenBSD: atomicio.c,v 1.27 2015/01/16 06:40:12 deraadt Exp $ */ +/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ /* * Copyright (c) 2006 Damien Miller. All rights reserved. * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. @@ -107,12 +107,12 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, struct iovec iov_array[IOV_MAX], *iov = iov_array; struct pollfd pfd; - if (iovcnt > IOV_MAX) { + if (iovcnt < 0 || iovcnt > IOV_MAX) { errno = EINVAL; return 0; } /* Make a copy of the iov array because we may modify it below */ - memcpy(iov, _iov, iovcnt * sizeof(*_iov)); + memcpy(iov, _iov, (size_t)iovcnt * sizeof(*_iov)); #ifndef BROKEN_READV_COMPARISON pfd.fd = fd; -- cgit v1.2.3