diff options
| -rw-r--r-- | source3/lib/unix_msg/unix_msg.c | 19 | ||||
| -rw-r--r-- | source3/modules/vfs_aio_fork.c | 5 |
2 files changed, 14 insertions, 10 deletions
diff --git a/source3/lib/unix_msg/unix_msg.c b/source3/lib/unix_msg/unix_msg.c index 4870068383..00ac7f52d3 100644 --- a/source3/lib/unix_msg/unix_msg.c +++ b/source3/lib/unix_msg/unix_msg.c @@ -477,7 +477,7 @@ static int queue_msg(struct unix_dgram_send_queue *q, struct unix_dgram_msg *msg; ssize_t data_len; uint8_t *data_buf; - size_t msglen; + size_t msglen = sizeof(struct unix_dgram_msg); int i; size_t tmp; int ret = -1; @@ -487,6 +487,13 @@ static int queue_msg(struct unix_dgram_send_queue *q, size_t cmsg_len = CMSG_LEN(fds_size); size_t cmsg_space = CMSG_SPACE(fds_size); char *cmsg_buf; + + /* + * Note: No need to check for overflow here, + * since cmsg will store <= INT8_MAX fds. + */ + msglen += cmsg_space; + #endif /* HAVE_STRUCT_MSGHDR_MSG_CONTROL */ if (num_fds > INT8_MAX) { @@ -499,14 +506,6 @@ static int queue_msg(struct unix_dgram_send_queue *q, } #endif - msglen = sizeof(struct unix_dgram_msg); - - /* - * Note: No need to check for overflow here, - * since cmsg will store <= INT8_MAX fds. - */ - msglen += cmsg_space; - data_len = iov_buflen(iov, iovlen); if (data_len == -1) { return EINVAL; @@ -593,7 +592,9 @@ static int queue_msg(struct unix_dgram_send_queue *q, return 0; fail: +#ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL close_fd_array(fds_copy, num_fds); +#endif return ret; } diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c index c1bded98c5..12e6f80257 100644 --- a/source3/modules/vfs_aio_fork.c +++ b/source3/modules/vfs_aio_fork.c @@ -157,6 +157,7 @@ static ssize_t read_fd(int fd, void *ptr, size_t nbytes, int *recvfd) #ifndef HAVE_STRUCT_MSGHDR_MSG_CONTROL int newfd; + ZERO_STRUCT(msg); msg.msg_accrights = (caddr_t) &newfd; msg.msg_accrightslen = sizeof(int); #else @@ -167,13 +168,15 @@ static ssize_t read_fd(int fd, void *ptr, size_t nbytes, int *recvfd) } control_un; struct cmsghdr *cmptr; + ZERO_STRUCT(msg); + ZERO_STRUCT(control_un); + msg.msg_control = control_un.control; msg.msg_controllen = sizeof(control_un.control); #endif msg.msg_name = NULL; msg.msg_namelen = 0; - msg.msg_flags = 0; iov[0].iov_base = (void *)ptr; iov[0].iov_len = nbytes; |