smbd: Simplify inotify_handler()

Now that we don't have to calculate "e2" anymore, we can simplify the
loop walking the buffer.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15864
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Jun  2 18:10:20 UTC 2025 on atb-devel-224

diff --git a/source3/smbd/notify_inotify.c b/source3/smbd/notify_inotify.c
index d19b4a4cb653a618422648c6e24788da795f525d..4275b22144032b077e6527f58a9ec3782177628e 100644 (file)
--- a/source3/smbd/notify_inotify.c
+++ b/source3/smbd/notify_inotify.c
@@ -423,14 +423,21 @@ static void inotify_handler(struct tevent_context *ev, struct tevent_fd *fde,
        e = (struct inotify_event *)buf;
 
        /* we can get more than one event in the buffer */
-       while (e && (bufsize >= sizeof(*e))) {
-               struct inotify_event *e2 = NULL;
-               bufsize -= e->len + sizeof(*e);
-               if (bufsize >= sizeof(*e)) {
-                       e2 = (struct inotify_event *)(e->len + sizeof(*e) + (char *)e);
+       while (bufsize >= sizeof(struct inotify_event)) {
+               size_t e_len = sizeof(struct inotify_event) + e->len;
+
+               if ((e_len < sizeof(struct inotify_event)) ||
+                   (e_len > bufsize))
+               {
+                       DBG_ERR("Invalid data from inotify\n");
+                       TALLOC_FREE(fde);
+                       return;
                }
+
                inotify_dispatch(ev, in, e);
-               e = e2;
+
+               e = (struct inotify_event *)((char *)e + e_len);
+               bufsize -= e_len;
        }
 }