Peter Harris <[email protected]> writes: > When (long) is larger than (int), and when realloc succeeds with sizes > larger than INT_MAX, ConnectionOutput->size and ConnectionOutput->count > overflow and become negative. > > When ConnectionOutput->count is negative, InsertIOV does not actually > insert an IOV, and FlushClient goes into an infinite loop of writev(fd, > iov, 0) [an empty list]. > > Avoid this situation by killing the client when it has more than INT_MAX > unread bytes of data. > > Signed-off-by: Peter Harris <[email protected]> > --- > > Alternatively, we could change ->size and ->count to long (or ssize_t or > ptrdiff_t).
A client which is more than 2GB behind is unlikely to be useful. Reviewed-by: Keith Packard <[email protected]> -- [email protected]
signature.asc
Description: PGP signature
_______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
