diff options
| author | Volker Lendecke <vl@samba.org> | 2015-03-04 09:49:18 +0100 |
|---|---|---|
| committer | David Disseldorp <ddiss@samba.org> | 2015-03-04 14:46:07 +0100 |
| commit | f5c8e489ad5b71f000be61384be93e2e348b373d (patch) | |
| tree | eab7e3452eb0032c6cfe286df39df1f5c38699b4 /source3/lib | |
| parent | 6fdbf8de87521ea6f08cda6edf7129bdb6987968 (diff) | |
| download | samba-f5c8e489ad5b71f000be61384be93e2e348b373d.tar.gz samba-f5c8e489ad5b71f000be61384be93e2e348b373d.tar.xz samba-f5c8e489ad5b71f000be61384be93e2e348b373d.zip | |
lib: Fix CID 1273056 Negative array index read
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Diffstat (limited to 'source3/lib')
| -rw-r--r-- | source3/lib/msghdr.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/source3/lib/msghdr.c b/source3/lib/msghdr.c index 5d771e8958..de0eed4626 100644 --- a/source3/lib/msghdr.c +++ b/source3/lib/msghdr.c @@ -70,13 +70,18 @@ ssize_t msghdr_copy(struct msghdr_buf *msg, size_t msgsize, const struct iovec *iov, int iovcnt, const int *fds, size_t num_fds) { - size_t fd_len, iov_len, needed, bufsize; + ssize_t fd_len; + size_t iov_len, needed, bufsize; bufsize = (msgsize > offsetof(struct msghdr_buf, buf)) ? msgsize - offsetof(struct msghdr_buf, buf) : 0; fd_len = msghdr_prep_fds(&msg->msg, msg->buf, bufsize, fds, num_fds); + if (fd_len == -1) { + return -1; + } + if (bufsize >= fd_len) { bufsize -= fd_len; } else { |