summaryrefslogtreecommitdiff
path: root/atomicio.c
diff options
context:
space:
mode:
authordjm@openbsd.org <djm@openbsd.org>2016-07-27 23:18:12 +0000
committerDarren Tucker <dtucker@zip.com.au>2016-08-03 15:38:43 +1000
commitd7e7348e72f9b203189e3fffb75605afecba4fda (patch)
treeb2497e60e49d9937c3370b93b46f075ed619c003 /atomicio.c
parent5faa52d295f764562ed6dd75c4a4ce9134ae71e3 (diff)
upstream commit
better bounds check on iovcnt (we only ever use fixed, positive values) Upstream-ID: 9baa6eb5cd6e30c9dc7398e5fe853721a3a5bdee
Diffstat (limited to 'atomicio.c')
-rw-r--r--atomicio.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/atomicio.c b/atomicio.c
index b1ec234f..f854a06f 100644
--- a/atomicio.c
+++ b/atomicio.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: atomicio.c,v 1.27 2015/01/16 06:40:12 deraadt Exp $ */
+/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */
/*
* Copyright (c) 2006 Damien Miller. All rights reserved.
* Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
@@ -107,12 +107,12 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd,
struct iovec iov_array[IOV_MAX], *iov = iov_array;
struct pollfd pfd;
- if (iovcnt > IOV_MAX) {
+ if (iovcnt < 0 || iovcnt > IOV_MAX) {
errno = EINVAL;
return 0;
}
/* Make a copy of the iov array because we may modify it below */
- memcpy(iov, _iov, iovcnt * sizeof(*_iov));
+ memcpy(iov, _iov, (size_t)iovcnt * sizeof(*_iov));
#ifndef BROKEN_READV_COMPARISON
pfd.fd = fd;