From 1a00a7fdf597c91d7edf5497ca71512520f4b9e9 Mon Sep 17 00:00:00 2001 From: Andrew Wood Date: Fri, 15 May 2026 23:42:49 +0100 Subject: [PATCH] Correct the off_t/size_t max_to_write overflow check. --- src/pv/transfer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pv/transfer.c b/src/pv/transfer.c index b06345b..11132a0 100644 --- a/src/pv/transfer.c +++ b/src/pv/transfer.c @@ -428,8 +428,10 @@ static ssize_t pv__transfer__splice_repeated(pvstate_t state, int input_fd, int bytes_to_splice = count; /*@-unrecog@ */ if ((state->control.rate_limit_active || max_to_write != 0) - && (max_to_write <= (off_t) SIZE_MAX && bytes_to_splice > (size_t) max_to_write)) + && (max_to_write >= 0) && ((unsigned long) max_to_write <= (unsigned long) SIZE_MAX) + && ((off_t) bytes_to_splice > max_to_write)) { bytes_to_splice = (size_t) max_to_write; + } /*@+unrecog@ *//* splint doesn't know of SIZE_MAX. */ /* Early return with 0 if the transfer cap is zero. */