Fix for evbuffer_read() when all data fits in penultimate chain.

Previously we were reading into the next-to-last chain, but incrementing
the fullness of the last.  Bug found by Victor Goya.

svn:r1237
This commit is contained in:
Nick Mathewson 2009-04-23 21:41:53 +00:00
parent faa756c7c1
commit ec6bfd0335

View File

@ -1470,9 +1470,11 @@ _evbuffer_read_setup_vecs(struct evbuffer *buf, ssize_t howmuch,
if (vecs[0].IOV_LEN_FIELD >= howmuch) { if (vecs[0].IOV_LEN_FIELD >= howmuch) {
/* The next-to-last chain has enough /* The next-to-last chain has enough
* space on its own. */ * space on its own. */
chain = prev;
nvecs = 1; nvecs = 1;
} else { } else {
/* We'll need both chains. */ /* We'll need both chains. */
chain = prev;
nvecs = 2; nvecs = 2;
if (vecs[0].IOV_LEN_FIELD + vecs[1].IOV_LEN_FIELD > howmuch) { if (vecs[0].IOV_LEN_FIELD + vecs[1].IOV_LEN_FIELD > howmuch) {
vecs[1].IOV_LEN_FIELD = howmuch - vecs[0].IOV_LEN_FIELD; vecs[1].IOV_LEN_FIELD = howmuch - vecs[0].IOV_LEN_FIELD;
@ -1604,12 +1606,12 @@ evbuffer_read(struct evbuffer *buf, evutil_socket_t fd, int howmuch)
#ifdef USE_IOVEC_IMPL #ifdef USE_IOVEC_IMPL
if (nvecs == 2) { if (nvecs == 2) {
size_t space = CHAIN_SPACE_LEN(buf->previous_to_last); size_t space = CHAIN_SPACE_LEN(chain);
if (space < n) { if (space < n) {
buf->previous_to_last->off += space; chain->off += space;
chain->off += n-space; chain->next->off += n-space;
} else { } else {
buf->previous_to_last->off += n; chain->off += n;
} }
} else { } else {
chain->off += n; chain->off += n;