2 files changed, 9 insertions, 5 deletions

diff --git a/cpp/src/qpid/sys/rdma/RdmaIO.cpp b/cpp/src/qpid/sys/rdma/RdmaIO.cpp
index af58b7deb0..78bcdec68e 100644
--- a/cpp/src/qpid/sys/rdma/RdmaIO.cpp
+++ b/cpp/src/qpid/sys/rdma/RdmaIO.cpp
@@ -140,7 +140,7 @@ namespace Rdma {
         // Prepost recv buffers before we go any further
         qp->allocateRecvBuffers(recvBufferCount, bufferSize+FrameHeaderSize);
 
-        // Create xmit buffers
+        // Create xmit buffers, reserve space for frame header.
         qp->createSendBuffers(xmitBufferCount, bufferSize, FrameHeaderSize);
     }
 
@@ -210,12 +210,14 @@ namespace Rdma {
             }
             break;
         case 1:
-            Buffer* ob = buff ? buff : getSendBuffer();
+            if (!buff)
+                buff = getSendBuffer();
             // Add FrameHeader after frame data
             FrameHeader header(credit);
-            ::memcpy(ob->bytes()+ob->dataCount(), &header, FrameHeaderSize);
-            ob->dataCount(ob->dataCount()+FrameHeaderSize);
-            qp->postSend(ob);
+            assert(buff->dataCount() <= buff->byteCount());   // ensure app data doesn't impinge on reserved space.
+            ::memcpy(buff->bytes()+buff->dataCount(), &header, FrameHeaderSize);
+            buff->dataCount(buff->dataCount()+FrameHeaderSize);
+            qp->postSend(buff);
             break;
         }
     }
diff --git a/cpp/src/qpid/sys/rdma/rdma_wrap.h b/cpp/src/qpid/sys/rdma/rdma_wrap.h
index 3737664bde..8e3429027b 100644
--- a/cpp/src/qpid/sys/rdma/rdma_wrap.h
+++ b/cpp/src/qpid/sys/rdma/rdma_wrap.h
@@ -77,6 +77,8 @@ namespace Rdma {
     }
 
     inline void Buffer::dataCount(int32_t s) {
+        // catch any attempt to overflow a buffer
+        assert(s <= bufferSize + reserved);
         sge.length = s;
     }