From: Jeffrey Altman <jaltman@your-file-system.com>
Date: Mon, 26 Jan 2009 22:53:48 +0000 (+0000)
Subject: rx-slow-write-packet-20090126
X-Git-Tag: openafs-devel-1_5_61~568
X-Git-Url: https://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=6e8039e8a55056f19895036ef6784f4fab5ab758

rx-slow-write-packet-20090126

LICENSE MIT

In rx_SlowWritePacket the use of RX_MAXWVECS was incorrect.  The
niovecs field is allocated as [RX_MAXWVECS+1] with the 0th element
reserved for the rx header.  niovecs[RX_MAXWVECS] is therefore a
valid data buffer and the comparison should be (i <= RX_MAXWVECS).

This error has most likely not been noticed previously because
nothing in the OpenAFS source tree uses this function.
---

diff --git a/src/rx/rx_packet.c b/src/rx/rx_packet.c
index aa6058e..c11fbb9 100644
--- a/src/rx/rx_packet.c
+++ b/src/rx/rx_packet.c
@@ -230,7 +230,7 @@ rx_SlowWritePacket(struct rx_packet * packet, int offset, int resid, char *in)
      * offset only applies to the first iovec.
      */
     r = resid;
-    while ((resid > 0) && (i < RX_MAXWVECS)) {
+    while ((resid > 0) && (i <= RX_MAXWVECS)) {
 	if (i >= packet->niovecs)
 	    if (rxi_AllocDataBuf(packet, resid, RX_PACKET_CLASS_SEND_CBUF) > 0)	/* ++niovecs as a side-effect */
 		break;