erofs-utils: fix potential buffer overrun in __erofs_io_write()
authorGao Xiang <hsiangkao@linux.alibaba.com>
Mon, 17 Feb 2025 02:49:28 +0000 (10:49 +0800)
committerGao Xiang <hsiangkao@linux.alibaba.com>
Mon, 17 Feb 2025 02:59:48 +0000 (10:59 +0800)
.. due to short write, but it's almost impossible for most fses.

Coverity-id: 541575
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250217024929.66658-1-hsiangkao@linux.alibaba.com
lib/io.c

index b6eb22aedb43b79eaef51e0a05b6bc3e83292bc0..5c3d263d53d789dfcccbf3329d939782ab1c1c37 100644 (file)
--- a/lib/io.c
+++ b/lib/io.c
@@ -31,7 +31,7 @@ ssize_t __erofs_io_write(int fd, const void *buf, size_t len)
        ssize_t ret, written = 0;
 
        do {
-               ret = write(fd, buf, len);
+               ret = write(fd, buf, len - written);
                if (ret <= 0) {
                        if (!ret)
                                break;