[SCM] Samba Shared Repository - branch master updated - release-4-0-0alpha7-999-gf20f5ae

[Stefan Metzmacher]

The branch, master has been updated
       via  f20f5ae8e6b9ca5c90441a3083f6904168388fdf (commit)
      from  bc5cd077643bc73d93fa73970761f8d1708d14a9 (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit f20f5ae8e6b9ca5c90441a3083f6904168388fdf
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Apr 8 19:08:34 2009 +0200

    socket_wrapper: fix crash bug in swrap_readv/writev
    
    metze

-----------------------------------------------------------------------

Summary of changes:
 lib/socket_wrapper/socket_wrapper.c |   14 ++++++++++----
 1 files changed, 10 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/socket_wrapper/socket_wrapper.c b/lib/socket_wrapper/socket_wrapper.c
index 553827b..d3853de 100644
--- a/lib/socket_wrapper/socket_wrapper.c
+++ b/lib/socket_wrapper/socket_wrapper.c
@@ -2101,6 +2101,7 @@ int swrap_readv(int s, const struct iovec *vector, size_t count)
 		uint8_t *buf;
 		off_t ofs = 0;
 		size_t i;
+		size_t remain = ret;
 
 		/* we capture it as one single packet */
 		buf = (uint8_t *)malloc(ret);
@@ -2111,10 +2112,12 @@ int swrap_readv(int s, const struct iovec *vector, size_t count)
 		}
 
 		for (i=0; i < count; i++) {
+			size_t this_time = MIN(remain, vector[i].iov_len);
 			memcpy(buf + ofs,
 			       vector[i].iov_base,
-			       vector[i].iov_len);
-			ofs += vector[i].iov_len;
+			       this_time);
+			ofs += this_time;
+			remain -= this_time;
 		}
 
 		swrap_dump_packet(si, NULL, SWRAP_RECV, buf, ret);
@@ -2161,6 +2164,7 @@ int swrap_writev(int s, const struct iovec *vector, size_t count)
 		uint8_t *buf;
 		off_t ofs = 0;
 		size_t i;
+		size_t remain = ret;
 
 		/* we capture it as one single packet */
 		buf = (uint8_t *)malloc(ret);
@@ -2171,10 +2175,12 @@ int swrap_writev(int s, const struct iovec *vector, size_t count)
 		}
 
 		for (i=0; i < count; i++) {
+			size_t this_time = MIN(remain, vector[i].iov_len);
 			memcpy(buf + ofs,
 			       vector[i].iov_base,
-			       vector[i].iov_len);
-			ofs += vector[i].iov_len;
+			       this_time);
+			ofs += this_time;
+			remain -= this_time;
 		}
 
 		swrap_dump_packet(si, NULL, SWRAP_SEND, buf, ret);


-- 
Samba Shared Repository