Skip to content

Commit

Permalink
revokefs: Fix off-by-one array size in fuse implementation
Browse files Browse the repository at this point in the history
The iovec write_vecs[] array on the stack was just 2 element, but we
sometimes use 3 elements of it. This was causing random crashes due to
corrupting the stack.

Closes: #3110
Approved by: alexlarsson
  • Loading branch information
alexlarsson authored and rh-atomic-bot committed Sep 18, 2019
1 parent 13279af commit 84e7b19
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion revokefs/writer.c
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ do_request (int writer_socket,
size_t request_size;
size_t response_max_size;
ssize_t written_size, read_size;
struct iovec write_vecs[2] = {};
struct iovec write_vecs[3] = {};
int n_write_vecs = 0;
struct iovec read_vecs[2] = {};
int n_read_vecs = 0;
Expand Down

0 comments on commit 84e7b19

Please sign in to comment.