svn rev #21898: trunk/src/lib/krb5/rcache/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=21898
Commit By: ghudson
Log Message:
In krb5_rc_io_store, check the return value of krb5int_buf_len as well
as krb5int_buf_data.  The length can't be negative if the data is
non-NULL, but Coverity doesn't know that.



Changed Files:
U   trunk/src/lib/krb5/rcache/rc_dfl.c
Modified: trunk/src/lib/krb5/rcache/rc_dfl.c
===================================================================
--- trunk/src/lib/krb5/rcache/rc_dfl.c	2009-02-05 19:50:41 UTC (rev 21897)
+++ trunk/src/lib/krb5/rcache/rc_dfl.c	2009-02-05 19:59:09 UTC (rev 21898)
@@ -656,10 +656,11 @@
                  krb5_donot_replay *rep)
 {
     size_t clientlen, serverlen;
+    ssize_t buflen;
     unsigned int len;
     krb5_error_code ret;
     struct k5buf buf, extbuf;
-    char *ptr, *extstr;
+    char *bufptr, *extstr;
 
     clientlen = strlen(rep->client);
     serverlen = strlen(rep->server);
@@ -706,11 +707,12 @@
     krb5int_buf_add_len(&buf, (char *) &rep->cusec, sizeof(rep->cusec));
     krb5int_buf_add_len(&buf, (char *) &rep->ctime, sizeof(rep->ctime));
 
-    ptr = krb5int_buf_data(&buf);
-    if (ptr == NULL)
+    bufptr = krb5int_buf_data(&buf);
+    buflen = krb5int_buf_len(&buf);
+    if (bufptr == NULL || buflen < 0)
         return KRB5_RC_MALLOC;
 
-    ret = krb5_rc_io_write(context, &t->d, ptr, krb5int_buf_len(&buf));
+    ret = krb5_rc_io_write(context, &t->d, bufptr, buflen);
     krb5int_free_buf(&buf);
     return ret;
 }