lib: Fix CID 1273056 Negative array index read

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

diff --git a/source3/lib/msghdr.c b/source3/lib/msghdr.c
index 5d771e8958ef23ea981cad6cf844e0325563c26a..de0eed46264b18adfc00a49775c14b175e5442c0 100644 (file)
--- a/source3/lib/msghdr.c
+++ b/source3/lib/msghdr.c
@@ -70,13 +70,18 @@ ssize_t msghdr_copy(struct msghdr_buf *msg, size_t msgsize,
                    const struct iovec *iov, int iovcnt,
                    const int *fds, size_t num_fds)
 {
-       size_t fd_len, iov_len, needed, bufsize;
+       ssize_t fd_len;
+       size_t iov_len, needed, bufsize;
 
        bufsize = (msgsize > offsetof(struct msghdr_buf, buf)) ?
                msgsize - offsetof(struct msghdr_buf, buf) : 0;
 
        fd_len = msghdr_prep_fds(&msg->msg, msg->buf, bufsize, fds, num_fds);
 
+       if (fd_len == -1) {
+               return -1;
+       }
+
        if (bufsize >= fd_len) {
                bufsize -= fd_len;
        } else {