MINOR: shctx: clamp shctx_row_data_get() reads against the offset

The length clamp capped the request to the whole row length but ignored
<offset>, so a read starting past the beginning of the row could run
beyond the stored data and copy stale bytes from the reserved tail of
its blocks. No current caller reads past first->len so this was never
triggered, but the helper is public and its contract does not forbid it.

Clamp against (first->len - offset) instead, returning early when the
offset is already at or past the stored data.

This may be backported along with the shctx_row_data_get() offset fix.

diff --git a/src/shctx.c b/src/shctx.c
index cb580b14eecf50b8076334117256b2ab58d1fa35..2d443133e319eb1c325a50cca3dc91753289463f 100644 (file)
--- a/src/shctx.c
+++ b/src/shctx.c
@@ -229,9 +229,11 @@ int shctx_row_data_get(struct shared_context *shctx, struct shared_block *first,
        int count, size, start = -1;
        struct shared_block *block;
 
-       /* can't copy more */
-       if (len > first->len)
-               len = first->len;
+       /* can't copy more than what is stored past <offset> */
+       if (offset >= first->len)
+               return len;
+       if (len > first->len - offset)
+               len = first->len - offset;
 
        /* Walk the blocks, skipping those that precede the one holding <offset>. */
        for (block = first, count = 0; count < first->block_count && len > 0;