[SCM] Samba Shared Repository - branch v3-4-test updated - release-4-0-0alpha7-725-g4457625

[Stefan Metzmacher]

The branch, v3-4-test has been updated
       via  44576254f8c0d35327cfe8f9928f0efc987b5822 (commit)
      from  4a4047c3b08412cfdd8c03b1994a925e10fc4c4a (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-test


- Log -----------------------------------------------------------------
commit 44576254f8c0d35327cfe8f9928f0efc987b5822
Author: Stefan Metzmacher <me...@samba.org>
Date:   Wed Apr 8 19:08:34 2009 +0200

    socket_wrapper: fix crash bug in swrap_readv/writev
    
    metze
    (cherry picked from commit f20f5ae8e6b9ca5c90441a3083f6904168388fdf)

-----------------------------------------------------------------------

Summary of changes:
 lib/socket_wrapper/socket_wrapper.c |   14 ++++++++++----
 1 files changed, 10 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/socket_wrapper/socket_wrapper.c 
b/lib/socket_wrapper/socket_wrapper.c
index 44082e7..193e7a1 100644
--- a/lib/socket_wrapper/socket_wrapper.c
+++ b/lib/socket_wrapper/socket_wrapper.c
@@ -2053,6 +2053,7 @@ int swrap_readv(int s, const struct iovec *vector, size_t 
count)
                uint8_t *buf;
                off_t ofs = 0;
                size_t i;
+               size_t remain = ret;
 
                /* we capture it as one single packet */
                buf = (uint8_t *)malloc(ret);
@@ -2063,10 +2064,12 @@ int swrap_readv(int s, const struct iovec *vector, 
size_t count)
                }
 
                for (i=0; i < count; i++) {
+                       size_t this_time = MIN(remain, vector[i].iov_len);
                        memcpy(buf + ofs,
                               vector[i].iov_base,
-                              vector[i].iov_len);
-                       ofs += vector[i].iov_len;
+                              this_time);
+                       ofs += this_time;
+                       remain -= this_time;
                }
 
                swrap_dump_packet(si, NULL, SWRAP_RECV, buf, ret);
@@ -2113,6 +2116,7 @@ int swrap_writev(int s, const struct iovec *vector, 
size_t count)
                uint8_t *buf;
                off_t ofs = 0;
                size_t i;
+               size_t remain = ret;
 
                /* we capture it as one single packet */
                buf = (uint8_t *)malloc(ret);
@@ -2123,10 +2127,12 @@ int swrap_writev(int s, const struct iovec *vector, 
size_t count)
                }
 
                for (i=0; i < count; i++) {
+                       size_t this_time = MIN(remain, vector[i].iov_len);
                        memcpy(buf + ofs,
                               vector[i].iov_base,
-                              vector[i].iov_len);
-                       ofs += vector[i].iov_len;
+                              this_time);
+                       ofs += this_time;
+                       remain -= this_time;
                }
 
                swrap_dump_packet(si, NULL, SWRAP_SEND, buf, ret);


-- 
Samba Shared Repository