Fix buffer overrun in regexp matcher
[glibc.git] / sysdeps / posix / writev.c
blob514bd0bc3c080b03989e324d403ea8d280feca45
1 /* Copyright (C) 1991-2013 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <http://www.gnu.org/licenses/>. */
18 #include <stdlib.h>
19 #include <unistd.h>
20 #include <string.h>
21 #include <limits.h>
22 #include <stdbool.h>
23 #include <sys/param.h>
24 #include <sys/uio.h>
25 #include <errno.h>
28 static void
29 ifree (char **ptrp)
31 free (*ptrp);
35 /* Write data pointed by the buffers described by VECTOR, which
36 is a vector of COUNT 'struct iovec's, to file descriptor FD.
37 The data is written in the order specified.
38 Operates just like 'write' (see <unistd.h>) except that the data
39 are taken from VECTOR instead of a contiguous buffer. */
40 ssize_t
41 __libc_writev (int fd, const struct iovec *vector, int count)
43 /* Find the total number of bytes to be written. */
44 size_t bytes = 0;
45 for (int i = 0; i < count; ++i)
47 /* Check for ssize_t overflow. */
48 if (SSIZE_MAX - bytes < vector[i].iov_len)
50 __set_errno (EINVAL);
51 return -1;
53 bytes += vector[i].iov_len;
56 /* Allocate a temporary buffer to hold the data. We should normally
57 use alloca since it's faster and does not require synchronization
58 with other threads. But we cannot if the amount of memory
59 required is too large. */
60 char *buffer;
61 char *malloced_buffer __attribute__ ((__cleanup__ (ifree))) = NULL;
62 if (__libc_use_alloca (bytes))
63 buffer = (char *) __alloca (bytes);
64 else
66 malloced_buffer = buffer = (char *) malloc (bytes);
67 if (buffer == NULL)
68 /* XXX I don't know whether it is acceptable to try writing
69 the data in chunks. Probably not so we just fail here. */
70 return -1;
73 /* Copy the data into BUFFER. */
74 size_t to_copy = bytes;
75 char *bp = buffer;
76 for (int i = 0; i < count; ++i)
78 size_t copy = MIN (vector[i].iov_len, to_copy);
80 bp = __mempcpy ((void *) bp, (void *) vector[i].iov_base, copy);
82 to_copy -= copy;
83 if (to_copy == 0)
84 break;
87 ssize_t bytes_written = __write (fd, buffer, bytes);
89 return bytes_written;
91 #ifndef __libc_writev
92 strong_alias (__libc_writev, __writev)
93 weak_alias (__libc_writev, writev)
94 #endif