patch-2.2.8 linux/net/core/iovec.c

• Lines: 17
• Date: Mon May 10 09:55:25 1999
• Orig file: v2.2.7/linux/net/core/iovec.c
• Orig date: Mon Sep 28 10:51:36 1998

diff -u --recursive --new-file v2.2.7/linux/net/core/iovec.c linux/net/core/iovec.c
@@ -59,8 +59,15 @@
 		goto out;
 	m->msg_iov=iov;
 
-	for (err = 0, ct = 0; ct < m->msg_iovlen; ct++)
+	for (err = 0, ct = 0; ct < m->msg_iovlen; ct++) {
 		err += iov[ct].iov_len;
+		/* Goal is not to verify user data, but to prevent returning
+		   negative value, which is interpreted as errno.
+		   Overflow is still possible, but it is harmless.
+		 */
+		if (err < 0)
+			return -EMSGSIZE;
+	}
 out:
 	return err;
 }