diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2006-04-16 07:59:01 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2006-04-16 07:59:01 +0000 |
| commit | 543b9a39e4b14ee28eba4bc1f8e5f51721231be5 (patch) | |
| tree | 61aeeb182e77944337a9b2f262ec0414ffa1ed1a /usr.bin/ssh | |
| parent | d8b81748643c17a89008b36313d564f6a47dd056 (diff) | |
reorder sanity test so that it cannot dereference past the end of the
iov array; well spotted canacar@!
Diffstat (limited to 'usr.bin/ssh')
| -rw-r--r-- | usr.bin/ssh/atomicio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/ssh/atomicio.c b/usr.bin/ssh/atomicio.c index f8899f08b62..f19484af5c0 100644 --- a/usr.bin/ssh/atomicio.c +++ b/usr.bin/ssh/atomicio.c @@ -1,4 +1,4 @@ -/* $OpenBSD: atomicio.c,v 1.18 2006/04/16 00:52:55 djm Exp $ */ +/* $OpenBSD: atomicio.c,v 1.19 2006/04/16 07:59:00 djm Exp $ */ /* * Copyright (c) 2006 Damien Miller. All rights reserved. * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. @@ -95,7 +95,7 @@ atomiciov(ssize_t (*f) (int, const struct iovec *, int), int fd, iovcnt--; } /* This shouldn't happen... */ - if (rem > iov[0].iov_len || (rem > 0 && iovcnt <= 0)) { + if (rem > 0 && (iovcnt <= 0 || rem > iov[0].iov_len)) { errno = EFAULT; return 0; } |