Hello!

There was a data corruption possibility in the file.c:copy_file_file()
for a years. If mc_write() fails to write n_read bytes at once for some reason then n_read is fixed, but buf is not, so there are some pieces from beginning of buf instead of trailing part.


Possible scenario: copy/move file to some partition without enough space, remove some files to provide enough space and press "Retry".

Path commited.

--
Regards,
Andrew V. Samoilov
--- file.c~     Sun Dec 29 09:30:11 2002
+++ file.c      Wed Mar 26 11:11:23 2003
@@ -715,6 +715,7 @@ copy_file_file (FileOpContext *ctx, char
            gettimeofday (&tv_current, NULL);
 
            if (n_read > 0) {
+               char *t = buf;
                n_read_total += n_read;
 
                /* Windows NT ftp servers report that files have no
@@ -729,18 +730,18 @@ copy_file_file (FileOpContext *ctx, char
 
                /* dst_write */
                while ((n_written =
-                       mc_write (dest_desc, buf, n_read)) < n_read) {
+                       mc_write (dest_desc, t, n_read)) < n_read) {
                    if (n_written > 0) {
                        n_read -= n_written;
+                       t += n_written;
                        continue;
                    }
                    return_status =
                        file_error (_
                                    (" Cannot write target file \"%s\" \n %s "),
                                    dst_path);
-                   if (return_status == FILE_RETRY)
-                       continue;
-                   goto ret;
+                   if (return_status != FILE_RETRY)
+                       goto ret;
                }
            }
 

Reply via email to