diff options
| author | Andrew Morton <akpm@osdl.org> | 2004-04-11 22:58:16 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2004-04-11 22:58:16 -0700 |
| commit | fb14ef35baa4128d8ead9729678a251c5ea50559 (patch) | |
| tree | 408b5d41d1ea0e435418eb2dc2b28bc52e2b5b24 | |
| parent | b1ee3feafbe4f538ce4d65412d6bc9e83a96ee80 (diff) | |
[PATCH] readv/writev range checking fix
do-readv_writev() is trying to fail if
a) any of the segments have a length < 0 or
b) the sum of the segments wraps negative.
But it gets b) wrong because local variable tot_len is unsigned.
Fix that up.
| -rw-r--r-- | fs/read_write.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/read_write.c b/fs/read_write.c index 5c205418c3c9..b44fcbb94461 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -412,13 +412,13 @@ static ssize_t do_readv_writev(int type, struct file *file, */ tot_len = 0; ret = -EINVAL; - for (seg = 0 ; seg < nr_segs; seg++) { - ssize_t tmp = tot_len; + for (seg = 0; seg < nr_segs; seg++) { ssize_t len = (ssize_t)iov[seg].iov_len; + if (len < 0) /* size_t not fitting an ssize_t .. */ goto out; tot_len += len; - if (tot_len < tmp) /* maths overflow on the ssize_t */ + if ((ssize_t)tot_len < 0) /* maths overflow on the ssize_t */ goto out; } if (tot_len == 0) { |