Swatantra-66 commented on code in PR #21434:
URL: https://github.com/apache/nuttx/pull/21434#discussion_r4469232411
##########
net/usrsock/usrsock_sendmsg.c:
##########
@@ -160,12 +161,15 @@ static int do_sendto_request(FAR struct usrsock_conn_s
*conn,
for (i = 0; i < msg->msg_iovlen; i++)
{
- req.buflen += msg->msg_iov[i].iov_len;
- }
+ /* The sum of the iov_len values must fit in an ssize_t */
- if (req.buflen > UINT32_MAX)
- {
- req.buflen = UINT32_MAX;
+ if (msg->msg_iov[i].iov_len > SSIZE_MAX - req.buflen)
Review Comment:
On 64-bit platforms SSIZE_MAX is far above 4 GB while req.buflen is
uint32_t, so iov_len > SSIZE_MAX - req.buflen would indeed let two 2 GB buffers
pass and wrap req.buflen to 0.
I've updated the check to use (size_t)MIN(SSIZE_MAX, UINT32_MAX) -
req.buflen (with #include <sys/param.h>), giving a single unified bound that
enforces POSIX SSIZE_MAX on 32-bit and prevents 32-bit wrap on 64-bit, while
remaining -Wsign-compare clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
