]> granicus.if.org Git - libevent/commitdiff
Consistently check for failure from evbuffer_pullup()
authorNick Mathewson <nickm@torproject.org>
Fri, 29 Aug 2014 18:59:17 +0000 (14:59 -0400)
committerNick Mathewson <nickm@torproject.org>
Fri, 29 Aug 2014 18:59:17 +0000 (14:59 -0400)
Closes issue #148.

buffer.c
event_tagging.c

index 5fecb25b9a60e314c66f35bd648b0621ba1d9fbf..fab7d8085dcf7878026e4e450bc873fddf4cd80d 100644 (file)
--- a/buffer.c
+++ b/buffer.c
@@ -2363,9 +2363,11 @@ evbuffer_write_atmost(struct evbuffer *buffer, evutil_socket_t fd,
                /* XXX(nickm) Don't disable this code until we know if
                 * the WSARecv code above works. */
                void *p = evbuffer_pullup(buffer, howmuch);
+               EVUTIL_ASSERT(p || !howmuch);
                n = send(fd, p, howmuch, 0);
 #else
                void *p = evbuffer_pullup(buffer, howmuch);
+               EVUTIL_ASSERT(p || !howmuch);
                n = write(fd, p, howmuch);
 #endif
 #ifdef USE_SENDFILE
index a83e719f304fcfec6c64a7da96cce03ffe2a9f5f..eea4bfce70d739c6c99b68e62bbffa32d5d60aa6 100644 (file)
@@ -206,6 +206,8 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain)
         */
        data = evbuffer_pullup(
                evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1);
+       if (!data)
+               return (-1);
 
        while (count++ < len) {
                ev_uint8_t lower = *data++;
@@ -312,6 +314,8 @@ do {                                                                        \
                                                                        \
        /* XXX(niels): faster? */                                       \
        data = evbuffer_pullup(evbuf, offset + 1) + offset;             \
+       if (!data)                                                      \
+               return (-1);                                            \
                                                                        \
        nibbles = ((data[0] & 0xf0) >> 4) + 1;                          \
        if (nibbles > maxnibbles || (nibbles >> 1) + 1 > len)           \
@@ -319,6 +323,8 @@ do {                                                                        \
        len = (nibbles >> 1) + 1;                                       \
                                                                        \
        data = evbuffer_pullup(evbuf, offset + len) + offset;           \
+       if (!data)                                                      \
+               return (-1);                                            \
                                                                        \
        while (nibbles > 0) {                                           \
                number <<= 4;                                           \