Fix decompress out-of-bounds access (#463)
This commit is contained in:
parent
8f06d03ca6
commit
80be51e93b
@ -229,9 +229,9 @@ iov_increment(iov_iter *it)
|
||||
static inline void
|
||||
iov_add(iov_iter *it, size_t size)
|
||||
{
|
||||
while(true)
|
||||
while(size > 0)
|
||||
{
|
||||
assert(it->num <= it->cnt);
|
||||
assert(it->num < it->cnt);
|
||||
assert(it->iov[it->num].size > it->pos);
|
||||
|
||||
if(it->iov[it->num].size - it->pos > size)
|
||||
@ -244,6 +244,7 @@ iov_add(iov_iter *it, size_t size)
|
||||
// advance to next buffer
|
||||
size -= it->iov[it->num].size - it->pos;
|
||||
++it->num;
|
||||
assert(size == 0 || it->num < it->cnt);
|
||||
it->pos = 0;
|
||||
}
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user