read_writev: avoid reading past the last iovec elem

If iovcnt is exhausted and the first vector element's operation
is satisfied, the while loop will read past the end of the
iovec array.  This triggers the address sanitizer and leads to
undefined program state.  Avoid reading too far.
This commit is contained in:
Matthias Andree
2026-01-31 23:25:33 +01:00
committed by Simon Kelley
parent 3c830c4f1c
commit 40d1152059

View File

@@ -790,7 +790,7 @@ int read_writev(int fd, struct iovec *iov, int iovcnt, int rw)
return 0;
done += n;
while ((size_t)done >= iov[cur].iov_len)
while (cur < iovcnt && (size_t)done >= iov[cur].iov_len)
done -= iov[cur++].iov_len;
}