From a910f5ba6a97a84a37a610c04d888336786d1128 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 27 Mar 2025 14:55:41 +0100
Subject: [PATCH] vquic: obey IOV_MAX

When using `recvmmsg()`, check `IOV_MAX` for limits to the iovec array
passed.

Reported-by: Teh Kok How
Fixes #16846
Closes #16849
---
 lib/vquic/vquic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vquic/vquic.c b/lib/vquic/vquic.c
index 1e7a258b61..eb08ce7a22 100644
--- a/lib/vquic/vquic.c
+++ b/lib/vquic/vquic.c
@@ -379,7 +379,7 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
 
   total_nread = 0;
   while(pkts < max_pkts) {
-    n = (int)CURLMIN(MMSG_NUM, max_pkts);
+    n = (int)CURLMIN(CURLMIN(MMSG_NUM, IOV_MAX), max_pkts);
     memset(&mmsg, 0, sizeof(mmsg));
     for(i = 0; i < n; ++i) {
       msg_iov[i].iov_base = bufs[i];
-- 
2.47.2