diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2016-07-27 23:18:12 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@zip.com.au> | 2016-08-03 15:38:43 +1000 |
| commit | d7e7348e72f9b203189e3fffb75605afecba4fda (patch) | |
| tree | b2497e60e49d9937c3370b93b46f075ed619c003 /atomicio.c | |
| parent | 5faa52d295f764562ed6dd75c4a4ce9134ae71e3 (diff) | |
| download | openssh-git-d7e7348e72f9b203189e3fffb75605afecba4fda.tar.gz | |
upstream commit
better bounds check on iovcnt (we only ever use fixed,
positive values)
Upstream-ID: 9baa6eb5cd6e30c9dc7398e5fe853721a3a5bdee
Diffstat (limited to 'atomicio.c')
| -rw-r--r-- | atomicio.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: atomicio.c,v 1.27 2015/01/16 06:40:12 deraadt Exp $ */ +/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ /* * Copyright (c) 2006 Damien Miller. All rights reserved. * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. @@ -107,12 +107,12 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, struct iovec iov_array[IOV_MAX], *iov = iov_array; struct pollfd pfd; - if (iovcnt > IOV_MAX) { + if (iovcnt < 0 || iovcnt > IOV_MAX) { errno = EINVAL; return 0; } /* Make a copy of the iov array because we may modify it below */ - memcpy(iov, _iov, iovcnt * sizeof(*_iov)); + memcpy(iov, _iov, (size_t)iovcnt * sizeof(*_iov)); #ifndef BROKEN_READV_COMPARISON pfd.fd = fd; |