lkml.org 
[lkml]   [2002]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] 2.5.27 read_write - take 2
Alan Cox wrote:
> On Mon, 2002-07-22 at 15:08, Marcin Dalecki wrote:
>
>>- It is fixing completely confused wild casting to 32 bits.
>>
>>- Actually adding a comment explaining the obscure code, which is
>> relying on integer arithmetics overflow.
>
>
> Better yet take the code from 2.4.19-rc3. The code you fixed up is still
> wrong. Sincie iov_len is not permitted to exceed 2Gb (SuS v3, found by
> the LSB test suite) the actual fix turns out to be even simpler and
> cleaner than the one you did

You are right. It makes sese, since readv and writev are
supposed to return ssize_t. Fixed patch version attached.


diff -urN linux-2.5.27/fs/read_write.c linux/fs/read_write.c
--- linux-2.5.27/fs/read_write.c 2002-07-22 17:51:25.000000000 +0200
+++ linux/fs/read_write.c 2002-07-22 17:57:22.000000000 +0200
@@ -306,12 +306,16 @@
tot_len = 0;
ret = -EINVAL;
for (i = 0 ; i < count ; i++) {
- size_t tmp = tot_len;
- int len = iov[i].iov_len;
+ ssize_t tmp = tot_len;
+ ssize_t len = iov[i].iov_len;
+
+ /* check for SSIZE_MAX overflow */
if (len < 0)
goto out;
- (u32)tot_len += len;
- if (tot_len < tmp || tot_len < (u32)len)
+
+ tot_len += len;
+ /* check for overflows */
+ if (tot_len < tmp)
goto out;
}
\
 
 \ /
  Last update: 2005-03-22 13:27    [W:0.098 / U:0.508 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site