diff options
| author | Damien Miller <djm@mindrot.org> | 2006-04-23 04:06:49 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2006-04-23 04:06:49 +0200 |
| commit | b5ea7e7c037be2702fa1664b762aff2e019dcb0e (patch) | |
| tree | cbf2ef7cf131261a5862aec2f0c5ee09f544650d /atomicio.c | |
| parent | - djm@cvs.openbsd.org 2006/04/16 00:54:10 (diff) | |
| download | openssh-b5ea7e7c037be2702fa1664b762aff2e019dcb0e.tar.xz openssh-b5ea7e7c037be2702fa1664b762aff2e019dcb0e.zip | |
- djm@cvs.openbsd.org 2006/04/16 07:59:00
[atomicio.c]
reorder sanity test so that it cannot dereference past the end of the
iov array; well spotted canacar@!
Diffstat (limited to '')
| -rw-r--r-- | atomicio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/atomicio.c b/atomicio.c index de5363aa3..3939785df 100644 --- a/atomicio.c +++ b/atomicio.c @@ -1,4 +1,4 @@ -/* $OpenBSD: atomicio.c,v 1.18 2006/04/16 00:52:55 djm Exp $ */ +/* $OpenBSD: atomicio.c,v 1.19 2006/04/16 07:59:00 djm Exp $ */ /* * Copyright (c) 2006 Damien Miller. All rights reserved. * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. @@ -99,7 +99,7 @@ atomiciov(ssize_t (*f) (int, const struct iovec *, int), int fd, iovcnt--; } /* This shouldn't happen... */ - if (rem > iov[0].iov_len || (rem > 0 && iovcnt <= 0)) { + if (rem > 0 && (iovcnt <= 0 || rem > iov[0].iov_len)) { errno = EFAULT; return 0; } |