iov_tail_clone() returns a ssize_t. However, the assert comparing
it against (ARRAY_SIZE(iov_msg) - j), which yields size_t, comes
before the negative-value check. Hence, when iov_tail_clone() fails
and returns -1, the signed-to-unsigned promotion turns -1 into
SIZE_MAX, and causes the assert to fire.
We fix this by moving the error check before the assert, while casting
the counter and the index inside the assert to size_t.
Signed-off-by: Jon Maloy
---
tcp_vu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tcp_vu.c b/tcp_vu.c
index 868a35b9..c052d8e2 100644
--- a/tcp_vu.c
+++ b/tcp_vu.c
@@ -291,9 +291,9 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq,
cnt = iov_tail_clone(&iov_msg[j], ARRAY_SIZE(iov_msg) - j,
&data);
- assert(cnt < ARRAY_SIZE(iov_msg) - j);
if (cnt < 0)
die("Missing entries in iov_msg");
+ assert((size_t)cnt < ARRAY_SIZE(iov_msg) - (size_t)j);
j += cnt;
}
--
2.52.0