Commit Diff

Commit:
d20f7b514c649c94f9679f66792a95037466b7c1
From:
Omar Polo <op@omarpolo.com>
Date:
Message:
amused-web: avoid an (im)possible write out-of-bounds in buf_write spotted while bringing syncparty' bufio.[ch] in sync; if the requested len could be bigger than buf->len plus the buf_grow() increment, so we have to iterate. This is currently impossible since we're usign buf_write() only to add one byte.
Actions:
Patch | Tree
commit - 7f271cbcec370a1b367005ad2700cd161d183802
commit + d20f7b514c649c94f9679f66792a95037466b7c1
blob - d2b0020075d21db9c6ff1705fce193294e43735c
blob + da7bde52d49d841a387fa5a9526fe9bb66410503
--- web/bufio.c
+++ web/bufio.c
@@ -67,7 +67,7 @@ buf_grow(struct buffer *buf)
 int
 buf_write(struct buffer *buf, const void *d, size_t len)
 {
-	if (buf->len + len > buf->cap) {
+	while (buf->len + len > buf->cap) {
 		if (buf_grow(buf) == -1)
 			return (-1);
 	}