fix bug, trying to walk off the end of the argv array

[m6w6/libmemcached] / lib / memcached_flush.c

diff --git a/lib/memcached_flush.c b/lib/memcached_flush.c
index 8c51cdf1f85f8e9e44d3fa7a67fb673aac42aa52..07fc3ac0b63ce712e740ace8ffc819e887431e26 100644 (file)
--- a/lib/memcached_flush.c
+++ b/lib/memcached_flush.c
@@ -3,7 +3,7 @@
 memcached_return memcached_flush(memcached_st *ptr, time_t expiration)
 {
   unsigned int x;
-  size_t send_length;
+  size_t send_length, sent_length;
   memcached_return rc;
   char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE];
 
@@ -20,8 +20,24 @@ memcached_return memcached_flush(memcached_st *ptr, time_t expiration)
     else
       send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, 
                             "flush_all\r\n");
-    if ((write(ptr->hosts[x].fd, buffer, send_length) == -1))
+
+    if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE)
+      return MEMCACHED_WRITE_FAILURE;
+
+    sent_length= write(ptr->hosts[x].fd, buffer, send_length);
+
+    if (sent_length == -1)
+    {
+      fprintf(stderr, "error %s: write: %m\n", __FUNCTION__);
+      return MEMCACHED_WRITE_FAILURE;
+    }
+
+    if (sent_length != send_length)
+    {
+      fprintf(stderr, "error %s: short write %d %d: %m\n",
+             __FUNCTION__, sent_length, send_length);
       return MEMCACHED_WRITE_FAILURE;
+    }
 
     rc= memcached_response(ptr, buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, x);