DEVEL15-rx-slow-write-packet-20090126

LICENSE MIT

In rx_SlowWritePacket the use of RX_MAXWVECS was incorrect.  The
niovecs field is allocated as [RX_MAXWVECS+1] with the 0th element
reserved for the rx header.  niovecs[RX_MAXWVECS] is therefore a
valid data buffer and the comparison should be (i <= RX_MAXWVECS).

This error has most likely not been noticed previously because
nothing in the OpenAFS source tree uses this function.

(cherry picked from commit 6e8039e8a55056f19895036ef6784f4fab5ab758)

diff --git a/src/rx/rx_packet.c b/src/rx/rx_packet.c
index 202b7dd1213beac4aa2cde0322f78d4391127f0c..f03779752b1add72c50c90bb650774342364b88e 100644 (file)
--- a/src/rx/rx_packet.c
+++ b/src/rx/rx_packet.c
@@ -233,7 +233,7 @@ rx_SlowWritePacket(struct rx_packet * packet, int offset, int resid, char *in)
      * offset only applies to the first iovec.
      */
     r = resid;
-    while ((resid > 0) && (i < RX_MAXWVECS)) {
+    while ((resid > 0) && (i <= RX_MAXWVECS)) {
        if (i >= packet->niovecs)
            if (rxi_AllocDataBuf(packet, resid, RX_PACKET_CLASS_SEND_CBUF) > 0) /* ++niovecs as a side-effect */
                break;