From: David Goulet <dgoulet@efficios.com>
Date: Mon, 10 Feb 2014 18:43:08 +0000 (-0500)
Subject: Fix: in lttng_read/write deny count bigger than the possible returned value
X-Git-Tag: v2.4.0-rc5~26
X-Git-Url: https://git.liburcu.org/?a=commitdiff_plain;h=3b0989d14ecb6f2a31d30f39092396b47ecfe91e;p=lttng-tools.git

Fix: in lttng_read/write deny count bigger than the possible returned value

Signed-off-by: David Goulet <dgoulet@efficios.com>
---

diff --git a/src/common/readwrite.c b/src/common/readwrite.c
index 7b8460962..d33e05190 100644
--- a/src/common/readwrite.c
+++ b/src/common/readwrite.c
@@ -17,6 +17,7 @@
 
 #include <assert.h>
 #include <errno.h>
+#include <limits.h>
 #include <unistd.h>
 
 #include "readwrite.h"
@@ -36,6 +37,14 @@ ssize_t lttng_read(int fd, void *buf, size_t count)
 
 	assert(buf);
 
+	/*
+	 * Deny a read count that can be bigger then the returned value max size.
+	 * This makes the function to never return an overflow value.
+	 */
+	if (count > SSIZE_MAX) {
+		return -EINVAL;
+	}
+
 	do {
 		ret = read(fd, buf + i, count - i);
 		if (ret < 0) {
@@ -65,6 +74,14 @@ ssize_t lttng_write(int fd, const void *buf, size_t count)
 
 	assert(buf);
 
+	/*
+	 * Deny a write count that can be bigger then the returned value max size.
+	 * This makes the function to never return an overflow value.
+	 */
+	if (count > SSIZE_MAX) {
+		return -EINVAL;
+	}
+
 	do {
 		ret = write(fd, buf + i, count - i);
 		if (ret < 0) {