Bug 949060: Validate the 'iov' and 'vectors' input arguments of ssl_WriteV.

r=chris.newman.

1 files changed, 11 insertions, 0 deletions

diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
index 15344b877..c5aca21e2 100644
--- a/lib/ssl/sslsock.c
+++ b/lib/ssl/sslsock.c
@@ -2397,6 +2397,7 @@ static PRInt32 PR_CALLBACK
 ssl_WriteV(PRFileDesc *fd, const PRIOVec *iov, PRInt32 vectors, 
            PRIntervalTime timeout)
 {
+    PRInt32            i;
     PRInt32            bufLen;
     PRInt32            left;
     PRInt32            rv;
@@ -2407,10 +2408,20 @@ ssl_WriteV(PRFileDesc *fd, const PRIOVec *iov, PRInt32 vectors,
     PRIOVec            myIov	 = { 0, 0 };
     char               buf[MAX_FRAGMENT_LENGTH];
 
+    if (vectors < 0) {
+    	PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
+	return -1;
+    }
     if (vectors > PR_MAX_IOVECTOR_SIZE) {
     	PORT_SetError(PR_BUFFER_OVERFLOW_ERROR);
 	return -1;
     }
+    for (i = 0; i < vectors; i++) {
+	if (iov[i].iov_len < 0) {
+	    PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
+	    return -1;
+	}
+    }
     blocking = ssl_FdIsBlocking(fd);
 
 #define K16 sizeof(buf)