* debug/recv_chk.c (__recv_chk): Always fail if request could

	overflow the buffer.
	* debug/recvfrom_chk.c (__recvfrom_chk): Likewise.

diff --git a/ChangeLog b/ChangeLog
index f94c643..5492771 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2005-03-06  Ulrich Drepper  <drepper@redhat.com>
 
+       * debug/recv_chk.c (__recv_chk): Always fail if request could
+       overflow the buffer.
+       * debug/recvfrom_chk.c (__recvfrom_chk): Likewise.
        * socket/bits/socket2.h (recv): Avoid calls to the _chk variant if
        we know the call succeeds.
        (recvfrom): Likewise.

diff --git a/debug/recv_chk.c b/debug/recv_chk.c
index 7a49d17..479ebdf 100644 (file)
--- a/debug/recv_chk.c
+++ b/debug/recv_chk.c
@@ -23,11 +23,8 @@
 ssize_t
 __recv_chk (int fd, void *buf, size_t n, size_t buflen, int flags)
 {
-  /* In case N is greater than BUFLEN, we read BUFLEN+1 bytes.
-     This might overflow the buffer but the damage is reduced to just
-     one byte.  And the program will terminate right away.  */
-  ssize_t nrecv = __recv (fd, buf, MIN (n, buflen + 1), flags);
-  if (nrecv > 0 && (size_t) nrecv > buflen)
+  if (n > buflen)
     __chk_fail ();
-  return nrecv;
+
+  return __recv (fd, buf, n, flags);
 }

diff --git a/debug/recvfrom_chk.c b/debug/recvfrom_chk.c
index e1b1da7..9790a15 100644 (file)
--- a/debug/recvfrom_chk.c
+++ b/debug/recvfrom_chk.c
@@ -24,12 +24,8 @@ ssize_t
 __recvfrom_chk (int fd, void *buf, size_t n, size_t buflen, int flags,
                __SOCKADDR_ARG addr, socklen_t *addr_len)
 {
-  /* In case N is greater than BUFLEN, we read BUFLEN+1 bytes.
-     This might overflow the buffer but the damage is reduced to just
-     one byte.  And the program will terminate right away.  */
-  ssize_t nrecv = __recvfrom (fd, buf, MIN (n, buflen + 1), flags,
-                             addr, addr_len);
-  if (nrecv > 0 && (size_t) nrecv > buflen)
+  if (n > buflen)
     __chk_fail ();
-  return nrecv;
+
+  return __recvfrom (fd, buf, n, flags, addr, addr_len);
 }