[XrdCl] Fix infinite loop when copying data from msg body to user buf…

…fer.
xrootd · Apr 28, 2022 · b49c6e3 · b49c6e3
1 parent aab1dc4
commit b49c6e3
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 8 deletions.
diff --git a/src/XrdCl/XrdClInQueue.cc b/src/XrdCl/XrdClInQueue.cc
@@ -121,8 +121,8 @@ namespace XrdCl
   // is stored in msg
   //----------------------------------------------------------------------------
   MsgHandler *InQueue::GetHandlerForMessage( std::shared_ptr<Message> &msg,
-						                                         time_t                   &expires,
-						                                         uint16_t                 &action )
+						                                 time_t                   &expires,
+						                                 uint16_t                 &action )
   {
     time_t   exp = 0;
     uint16_t act = 0;

diff --git a/src/XrdCl/XrdClXRootDMsgHandler.hh b/src/XrdCl/XrdClXRootDMsgHandler.hh
@@ -648,26 +648,31 @@ namespace XrdCl
         return pgcnt;
       }
 
-      inline void Copy( uint32_t offchlst, char *buffer, size_t length )
+      inline void Copy( uint32_t usrbufoff, char *buffer, size_t length )
       {
         auto itr = pChunkList->begin();
+        uint64_t chunkbufoff = 0; // chunk buffer offset
         while( length > 0 )
         {
           // first find the right buffer
           char   *dstbuf = nullptr;
           size_t  cplen = 0;
           for( ; itr != pChunkList->end() ; ++itr )
           {
-            if( offchlst < itr->offset ||
-                offchlst >= itr->offset + itr->length )
+            if( usrbufoff < chunkbufoff ||
+                usrbufoff >= chunkbufoff + itr->length )
+            {
+              chunkbufoff += itr->length;
               continue;
-            size_t dstoff = offchlst - itr->offset;
+            }
+            size_t dstoff = usrbufoff - chunkbufoff;
             dstbuf = reinterpret_cast<char*>( itr->buffer ) + dstoff;
-            cplen = itr->length - cplen;
+            cplen = itr->length - dstoff;
             break;
           }
           // now do the copy
-          if( cplen > length ) cplen = length;
+          if( cplen > length )
+            cplen = length;
           memcpy( dstbuf, buffer, cplen );
           buffer += cplen;
           length -= cplen;