rx-slow-write-packet-20090126

LICENSE MIT

In rx_SlowWritePacket the use of RX_MAXWVECS was incorrect.  The
niovecs field is allocated as [RX_MAXWVECS+1] with the 0th element
reserved for the rx header.  niovecs[RX_MAXWVECS] is therefore a
valid data buffer and the comparison should be (i <= RX_MAXWVECS).

This error has most likely not been noticed previously because
nothing in the OpenAFS source tree uses this function.

diff --git a/src/rx/rx_packet.c b/src/rx/rx_packet.c
index aa6058e..c11fbb9 100644 (file)
--- a/src/rx/rx_packet.c
+++ b/src/rx/rx_packet.c
@@ -230,7 +230,7 @@ rx_SlowWritePacket(struct rx_packet * packet, int offset, int resid, char *in)
      * offset only applies to the first iovec.
      */
     r = resid;
-    while ((resid > 0) && (i < RX_MAXWVECS)) {
+    while ((resid > 0) && (i <= RX_MAXWVECS)) {
        if (i >= packet->niovecs)
            if (rxi_AllocDataBuf(packet, resid, RX_PACKET_CLASS_SEND_CBUF) > 0) /* ++niovecs as a side-effect */
                break;