diff options
| author | Evgeny Kotkov <kotkov@apache.org> | 2022-10-20 11:12:10 +0000 |
|---|---|---|
| committer | Evgeny Kotkov <kotkov@apache.org> | 2022-10-20 11:12:10 +0000 |
| commit | 833a333c88f6852f83d115dadb8a19001c8bd67a (patch) | |
| tree | 876ffcb15fdc22092126b7e49d502dba4d4b0eaf | |
| parent | 76c4c779ac6255ac392143227fb5e82011a62890 (diff) | |
| download | apr-833a333c88f6852f83d115dadb8a19001c8bd67a.tar.gz | |
On 1.7.x branch: Merge r1904735 from 1.8.x branch:
Following up on r1904715, rework the check to properly handle an
overflow when apr_size_t is 32-bit long.
git-svn-id: https://svn.apache.org/repos/asf/apr/apr/branches/1.7.x@1904736 13f79535-47bb-0310-9956-ffa450edef68
| -rw-r--r-- | network_io/win32/sendrecv.c | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/network_io/win32/sendrecv.c b/network_io/win32/sendrecv.c index f5f23d2c7..6620e1382 100644 --- a/network_io/win32/sendrecv.c +++ b/network_io/win32/sendrecv.c @@ -108,17 +108,12 @@ APR_DECLARE(apr_status_t) apr_socket_sendv(apr_socket_t *sock, total_len = 0; for (i = 0; i < in_vec; i++) { apr_size_t iov_len = vec[i].iov_len; - if (iov_len > MAXDWORD) { - /* WSASend() returns NumberOfBytesSent as DWORD, so any iovec - should be less than that. */ - return APR_EINVAL; - } - total_len += iov_len; - if (total_len > MAXDWORD) { + if (iov_len > (apr_size_t)MAXDWORD - total_len) { /* WSASend() returns NumberOfBytesSent as DWORD, so the total size should be less than that. */ return APR_EINVAL; } + total_len += iov_len; } pWsaBuf = (in_vec <= WSABUF_ON_STACK) ? _alloca(sizeof(WSABUF) * (in_vec)) |