io-util: protect against INT_MAX overflow in flush_fd()

(cherry picked from commit 874c4beb24ade904589bf672685752727cbb791e)
(cherry picked from commit 93fc50ec2b3f505e20774dda45b37f1b594a4226)

diff --git a/src/basic/io-util.c b/src/basic/io-util.c
index 6bcbef3413623dd624ff0f98c44fe952cffbecf5..b1ac7bc809c22ccf6a24e7cb53dc77f4c7fa1786 100644 (file)
--- a/src/basic/io-util.c
+++ b/src/basic/io-util.c
@@ -25,12 +25,10 @@ int flush_fd(int fd) {
                 int r;
 
                 r = fd_wait_for_event(fd, POLLIN, 0);
-                if (r < 0) {
-                        if (r == -EINTR)
-                                continue;
-
+                if (r == -EINTR)
+                        continue;
+                if (r < 0)
                         return r;
-                }
                 if (r == 0)
                         return count;
 
@@ -38,7 +36,6 @@ int flush_fd(int fd) {
                 if (l < 0) {
                         if (errno == EINTR)
                                 continue;
-
                         if (errno == EAGAIN)
                                 return count;
 
@@ -46,6 +43,9 @@ int flush_fd(int fd) {
                 } else if (l == 0)
                         return count;
 
+                if (l > INT_MAX-count) /* On overflow terminate */
+                        return INT_MAX;
+
                 count += (int) l;
         }
 }