From: Michal Schmidt <mschmidt@redhat.com>
Date: Tue, 16 Apr 2013 21:07:14 +0000 (+0200)
Subject: journal: fix off-by-one error in native message iovec counting
X-Git-Tag: v202~67
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=f6422def2c10aa0dea1b872d2f187853e61bd015

journal: fix off-by-one error in native message iovec counting

Thanks to Cristian Ciupitu for a reproducer.
https://bugzilla.redhat.com/show_bug.cgi?id=924359
---

diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
index 9d1f39f0c..f878dfc91 100644
--- a/src/journal/journald-native.c
+++ b/src/journal/journald-native.c
@@ -123,11 +123,12 @@ void server_process_native_message(
 
                 /* A property follows */
 
-                if (n+N_IOVEC_META_FIELDS >= m) {
+                /* n received properties, +1 for _TRANSPORT */
+                if (n + 1 + N_IOVEC_META_FIELDS >= m) {
                         struct iovec *c;
                         unsigned u;
 
-                        u = MAX((n+N_IOVEC_META_FIELDS+1) * 2U, 4U);
+                        u = MAX((n + 1 + N_IOVEC_META_FIELDS) * 2U, 4U);
                         c = realloc(iovec, u * sizeof(struct iovec));
                         if (!c) {
                                 log_oom();