From b627c47932e59071c15c3f93cca67df818865e9b Mon Sep 17 00:00:00 2001
From: Ingo Weinhold <ingo_weinhold@gmx.de>
Date: Thu, 31 Jul 2008 14:22:52 +0000
Subject: [PATCH] IORequest::Advance() would access the vec array out of bounds
 after advancing to the end of the request.

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@26699 a95241bf-73f2-0310-859d-f6bbb57e9c96
---
 src/system/kernel/device_manager/io_requests.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/system/kernel/device_manager/io_requests.cpp b/src/system/kernel/device_manager/io_requests.cpp
index 9e837423c2..60b717bad4 100644
--- a/src/system/kernel/device_manager/io_requests.cpp
+++ b/src/system/kernel/device_manager/io_requests.cpp
@@ -850,7 +850,9 @@ IORequest::Advance(size_t bySize)
 	fTransferSize += bySize;
 
 	iovec* vecs = fBuffer->Vecs();
-	while (vecs[fVecIndex].iov_len - fVecOffset <= bySize) {
+	uint32 vecCount = fBuffer->VecCount();
+	while (fVecIndex < vecCount
+			&& vecs[fVecIndex].iov_len - fVecOffset <= bySize) {
 		bySize -= vecs[fVecIndex].iov_len - fVecOffset;
 		fVecOffset = 0;
 		fVecIndex++;