Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IORequest::Advance() would access the vec array out of bounds after

Browse Source 
advancing to the end of the request.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@26699 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Ingo Weinhold 2008-07-31 14:22:52 +00:00
parent 97d52f8e2a
commit b627c47932
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/system/kernel/device_manager/io_requests.cpp
View File

@ -850,7 +850,9 @@ IORequest::Advance(size_t bySize)
fTransferSize += bySize;
iovec* vecs = fBuffer->Vecs();
while (vecs[fVecIndex].iov_len - fVecOffset <= bySize) {
uint32 vecCount = fBuffer->VecCount();
while (fVecIndex < vecCount
&& vecs[fVecIndex].iov_len - fVecOffset <= bySize) {
bySize -= vecs[fVecIndex].iov_len - fVecOffset;
fVecOffset = 0;
fVecIndex++;