Repository: incubator-mynewt-core
Updated Branches:
  refs/heads/develop 48ef7aea7 -> 96b7f79f2


os_mbuf_appendfrom - Detect source mbuf overrun.


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: 
http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/f1e34675
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/f1e34675
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/f1e34675

Branch: refs/heads/develop
Commit: f1e3467586b60f23219baef5aeaecf2f9cf9ee50
Parents: 48ef7ae
Author: Christopher Collins <[email protected]>
Authored: Tue Aug 9 12:29:28 2016 -0700
Committer: Christopher Collins <[email protected]>
Committed: Tue Aug 9 12:29:28 2016 -0700

----------------------------------------------------------------------
 libs/os/src/os_mbuf.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/f1e34675/libs/os/src/os_mbuf.c
----------------------------------------------------------------------
diff --git a/libs/os/src/os_mbuf.c b/libs/os/src/os_mbuf.c
index eda58ef..a2302df 100644
--- a/libs/os/src/os_mbuf.c
+++ b/libs/os/src/os_mbuf.c
@@ -520,6 +520,10 @@ err:
  * @param src_off               The absolute offset within the source mbuf
  *                                  chain to read from.
  * @param len                   The number of bytes to append.
+ *
+ * @return                      0 on success;
+ *                              OS_EINVAL if the specified range extends beyond
+ *                                  the end of the source mbuf chain.
  */
 int
 os_mbuf_appendfrom(struct os_mbuf *dst, const struct os_mbuf *src,
@@ -531,11 +535,11 @@ os_mbuf_appendfrom(struct os_mbuf *dst, const struct 
os_mbuf *src,
     int rc;
 
     src_cur_om = os_mbuf_off(src, src_off, &src_cur_off);
-    if (src_cur_om == NULL) {
-        return OS_EINVAL;
-    }
-
     while (len > 0) {
+        if (src_cur_om == NULL) {
+            return OS_EINVAL;
+        }
+
         chunk_sz = min(len, src_cur_om->om_len - src_cur_off);
         rc = os_mbuf_append(dst, src_cur_om->om_data + src_cur_off, chunk_sz);
         if (rc != 0) {

Reply via email to