On Mon, Dec 05, 2011 at 09:48:39PM +0530, M. Mohan Kumar wrote:
> @@ -187,59 +190,70 @@ size_t v9fs_unmarshal(struct iovec *out_sg, int
> out_num, size_t offset,
> }
> case 's': {
> V9fsString *str = va_arg(ap, V9fsString *);
> - offset += v9fs_unmarshal(out_sg, out_num, offset, bswap,
> - "w", &str->size);
> - /* FIXME: sanity check str->size */
> - str->data = g_malloc(str->size + 1);
> - offset += v9fs_unpack(str->data, out_sg, out_num, offset,
> - str->size);
> - str->data[str->size] = 0;
> + copied = v9fs_unmarshal(out_sg, out_num, offset, bswap,
> + "w", &str->size);
> + if (copied > 0) {
> + offset += copied;
> + str->data = g_malloc(str->size + 1);
str->size is signed int16_t, we need a check or the type should be
uint16_t.
Stefan
