Fix data corruption bug

[netatalk.git] / libatalk / dsi / dsi_stream.c

diff --git a/libatalk/dsi/dsi_stream.c b/libatalk/dsi/dsi_stream.c
index 97eb8ad717e96b17c493df472a2254be318a0c15..711a037b5098925c59c77198bb6350d390d9b5a3 100644 (file)
--- a/libatalk/dsi/dsi_stream.c
+++ b/libatalk/dsi/dsi_stream.c
@@ -364,7 +364,9 @@ ssize_t dsi_stream_read_file(DSI *dsi, const int fromfd, off_t offset, const siz
     sfvcnt = 2;
     vec[0].sfv_fd = SFV_FD_SELF;
     vec[0].sfv_flag = 0;
-    vec[0].sfv_off = block;
+    /* Cast to unsigned long to prevent sign extension of the
+     * pointer value for the LFS case; see Apache PR 39463. */
+    vec[0].sfv_off = (unsigned long)block;
     vec[0].sfv_len = DSI_BLOCKSIZ;
     vec[1].sfv_fd = fromfd;
     vec[1].sfv_flag = 0;
@@ -398,7 +400,7 @@ ssize_t dsi_stream_read_file(DSI *dsi, const int fromfd, off_t offset, const siz
 #endif /* defined(SOLARIS) || defined(FREEBSD) */
 #endif /* HAVE_SENDFILEV */
 
-                if (dsi_peek(dsi)) {
+                if (dsi_peek(dsi) != 0) {
                     ret = -1;
                     goto exit;
                 }
@@ -531,7 +533,7 @@ int dsi_stream_send(DSI *dsi, void *buf, size_t length)
           break;
       else if (len < 0) { /* error */
           if (errno == EAGAIN || errno == EWOULDBLOCK) {
-              if (!dsi_peek(dsi)) {
+              if (dsi_peek(dsi) == 0) {
                   continue;
               }
           }
@@ -594,7 +596,7 @@ int dsi_stream_receive(DSI *dsi)
   dsi->clientID = ntohs(dsi->header.dsi_requestID);
   
   /* make sure we don't over-write our buffers. */
-  dsi->cmdlen = MIN(ntohl(dsi->header.dsi_len), DSI_CMDSIZ);
+  dsi->cmdlen = MIN(ntohl(dsi->header.dsi_len), dsi->server_quantum);
   if (dsi_stream_read(dsi, dsi->commands, dsi->cmdlen) != dsi->cmdlen) 
     return 0;