Module Name: src
Committed By: kamil
Date: Tue Mar 24 01:13:41 UTC 2020
Modified Files:
src/lib/librumpuser: sp_common.c
Log Message:
Fix off-by-one
Before accessing array member, check whether it is not out of valid range.
Detected with ASan + RUMPKERNEL.
To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 src/lib/librumpuser/sp_common.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/librumpuser/sp_common.c
diff -u src/lib/librumpuser/sp_common.c:1.39 src/lib/librumpuser/sp_common.c:1.40
--- src/lib/librumpuser/sp_common.c:1.39 Mon Sep 5 20:41:59 2016
+++ src/lib/librumpuser/sp_common.c Tue Mar 24 01:13:41 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: sp_common.c,v 1.39 2016/09/05 20:41:59 dholland Exp $ */
+/* $NetBSD: sp_common.c,v 1.40 2020/03/24 01:13:41 kamil Exp $ */
/*
* Copyright (c) 2010, 2011 Antti Kantee. All Rights Reserved.
@@ -342,7 +342,7 @@ dosend(struct spclient *spc, struct iove
}
/* ok, need to adjust iovec for potential next round */
- while (n >= (ssize_t)iov[0].iov_len && iovlen) {
+ while (iovlen && n >= (ssize_t)iov[0].iov_len) {
n -= iov[0].iov_len;
iov++;
iovlen--;
