[atomicio.c]
reorder sanity test so that it cannot dereference past the end of the
iov array; well spotted canacar@!
commands, which would result in a separate tiny packet on the wire by
using atomiciov(writev, ...) to write the length and the command in one
pass; ok deraadt@
+ - djm@cvs.openbsd.org 2006/04/16 07:59:00
+ [atomicio.c]
+ reorder sanity test so that it cannot dereference past the end of the
+ iov array; well spotted canacar@!
20060421
- (djm) [Makefile.in configure.ac session.c sshpty.c]
-/* $OpenBSD: atomicio.c,v 1.18 2006/04/16 00:52:55 djm Exp $ */
+/* $OpenBSD: atomicio.c,v 1.19 2006/04/16 07:59:00 djm Exp $ */
/*
* Copyright (c) 2006 Damien Miller. All rights reserved.
* Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
iovcnt--;
}
/* This shouldn't happen... */
- if (rem > iov[0].iov_len || (rem > 0 && iovcnt <= 0)) {
+ if (rem > 0 && (iovcnt <= 0 || rem > iov[0].iov_len)) {
errno = EFAULT;
return 0;
}