@@ -1841,6 +1841,11 @@ allocate_iovec_app_buffer(wasm_module_inst_t module_inst,
18411841 for (total_size = 0 , i = 0 ; i < data_len ; i ++ , data ++ ) {
18421842 total_size += data -> buf_len ;
18431843 }
1844+
1845+ if (total_size == 0 ) {
1846+ return __WASI_EINVAL ;
1847+ }
1848+
18441849 if (total_size >= UINT32_MAX
18451850 || !(buf_begin = wasm_runtime_malloc ((uint32 )total_size ))) {
18461851 return __WASI_ENOMEM ;
@@ -1852,12 +1857,19 @@ allocate_iovec_app_buffer(wasm_module_inst_t module_inst,
18521857 return __WASI_ESUCCESS ;
18531858}
18541859
1860+ static inline size_t
1861+ min (size_t a , size_t b )
1862+ {
1863+ return a > b ? b : a ;
1864+ }
1865+
18551866static wasi_errno_t
18561867copy_buffer_to_iovec_app (wasm_module_inst_t module_inst , uint8 * buf_begin ,
18571868 uint32 buf_size , iovec_app_t * data , uint32 data_len )
18581869{
18591870 uint8 * buf = buf_begin ;
18601871 uint32 i ;
1872+ uint32 length_to_copy ;
18611873
18621874 for (i = 0 ; i < data_len ; data ++ , i ++ ) {
18631875 char * native_addr ;
@@ -1867,14 +1879,17 @@ copy_buffer_to_iovec_app(wasm_module_inst_t module_inst, uint8 *buf_begin,
18671879 }
18681880
18691881 if (buf >= buf_begin + buf_size
1870- || buf + data -> buf_len < buf /* integer overflow */
1871- || buf + data -> buf_len > buf_begin + buf_size ) {
1882+ || buf + data -> buf_len < buf /* integer overflow */ ) {
18721883 break ;
18731884 }
18741885
1886+ // If our app buffer size is smaller than the amount to be copied,
1887+ // only copy the amount in the app buffer
1888+ length_to_copy = min (data -> buf_len , buf_size );
1889+
18751890 native_addr = (void * )addr_app_to_native (data -> buf_offset );
1876- bh_memcpy_s (native_addr , data -> buf_len , buf , data -> buf_len );
1877- buf += data -> buf_len ;
1891+ bh_memcpy_s (native_addr , length_to_copy , buf , length_to_copy );
1892+ buf += length_to_copy ;
18781893 }
18791894
18801895 return __WASI_ESUCCESS ;
0 commit comments