Skip to content

Commit d8881ca

Browse files
committed
qubes_sendmsg_all: Avoid infinite loop on empty iovec
This is currently harmless because none of the callers pass an empty iovec, but this will change in the future.
1 parent f8d9343 commit d8881ca

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

libqrexec/ioall.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ int copy_fd_all(int fdout, int fdin)
219219

220220
bool qubes_sendmsg_all(struct msghdr *const msg, int const sock)
221221
{
222-
while (msg->msg_iovlen) {
222+
while (msg->msg_iovlen > 0) {
223223
ssize_t const res = sendmsg(sock, msg, MSG_NOSIGNAL);
224224
if (res < 0) {
225225
int const i = errno;
@@ -232,17 +232,18 @@ bool qubes_sendmsg_all(struct msghdr *const msg, int const sock)
232232
}
233233

234234
size_t unsigned_res = (size_t)res;
235-
while (unsigned_res) {
236-
assert(msg->msg_iovlen > 0);
235+
for (;;) {
237236
struct iovec *const v = msg->msg_iov;
238237
if (unsigned_res < v->iov_len) {
239238
v->iov_base += unsigned_res;
240239
v->iov_len -= unsigned_res;
241240
break;
242241
}
243-
unsigned_res -= msg->msg_iov[0].iov_len;
242+
unsigned_res -= v->iov_len;
244243
msg->msg_iovlen--;
245244
msg->msg_iov++;
245+
if (msg->msg_iovlen == 0)
246+
return true;
246247
}
247248
}
248249
return true;

0 commit comments

Comments
 (0)