Fix overflow of ConnectionOutput->size and ->count

 commit 4b0d0df34f10a88c10cb23dd50087b59f5c4fece
 Author: Peter Harris <pharris@opentext.com>
 Date:   Mon Nov 17 14:31:24 2014 -0500

    Fix overflow of ConnectionOutput->size and ->count

    When (long) is larger than (int), and when realloc succeeds with sizes
    larger than INT_MAX, ConnectionOutput->size and ConnectionOutput->count
    overflow and become negative.

    When ConnectionOutput->count is negative, InsertIOV does not actually
    insert an IOV, and FlushClient goes into an infinite loop of writev(fd,
    iov, 0) [an empty list].

    Avoid this situation by killing the client when it has more than INT_MAX
    unread bytes of data.

    Signed-off-by: Peter Harris <pharris@opentext.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>

 Backported-to-NX-by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

0 files changed, 0 insertions, 0 deletions