prov/sm2: fix incorrect data copy length

Coverity is complaining about a buffer overrun. This is because the copy from iov function is using the size as an offset into the comp array causing larger transfers to overflow Signed-off-by: Alexia Ingerson <[email protected]>
ofiwg · Mar 22, 2024 · fb314c6 · fb314c6
1 parent 54bffd8
commit fb314c6
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/prov/sm2/src/sm2_atomic.c b/prov/sm2/src/sm2_atomic.c
@@ -81,8 +81,7 @@ sm2_atomic_format(struct sm2_xfer_entry *xfer_entry, uint8_t datatype,
 		xfer_entry->hdr.size = ofi_copy_from_iov(
 			atomic_entry->atomic_data.buf,
 			SM2_ATOMIC_COMP_INJECT_SIZE, iov, iov_count, 0);
-		comp_size = ofi_copy_from_iov(atomic_entry->atomic_data.comp +
-						      xfer_entry->hdr.size,
+		comp_size = ofi_copy_from_iov(atomic_entry->atomic_data.comp,
 					      SM2_ATOMIC_COMP_INJECT_SIZE,
 					      compare_iov, compare_count, 0);
 		if (comp_size != xfer_entry->hdr.size)