From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 4 Jun 2025 14:05:41 +0000 (+0200)
Subject: io-util: protect against INT_MAX overflow in flush_fd()
X-Git-Tag: v256.17~33
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a332cc7f6a444e8f738476c2cc12d93ef286cf24;p=thirdparty%2Fsystemd.git

io-util: protect against INT_MAX overflow in flush_fd()

(cherry picked from commit 874c4beb24ade904589bf672685752727cbb791e)
(cherry picked from commit 93fc50ec2b3f505e20774dda45b37f1b594a4226)
---

diff --git a/src/basic/io-util.c b/src/basic/io-util.c
index 6bcbef34136..b1ac7bc809c 100644
--- a/src/basic/io-util.c
+++ b/src/basic/io-util.c
@@ -25,12 +25,10 @@ int flush_fd(int fd) {
                 int r;
 
                 r = fd_wait_for_event(fd, POLLIN, 0);
-                if (r < 0) {
-                        if (r == -EINTR)
-                                continue;
-
+                if (r == -EINTR)
+                        continue;
+                if (r < 0)
                         return r;
-                }
                 if (r == 0)
                         return count;
 
@@ -38,7 +36,6 @@ int flush_fd(int fd) {
                 if (l < 0) {
                         if (errno == EINTR)
                                 continue;
-
                         if (errno == EAGAIN)
                                 return count;
 
@@ -46,6 +43,9 @@ int flush_fd(int fd) {
                 } else if (l == 0)
                         return count;
 
+                if (l > INT_MAX-count) /* On overflow terminate */
+                        return INT_MAX;
+
                 count += (int) l;
         }
 }