Created attachment 14771 [details] IOV_MAX "off by one" issue fix in lib/tsocket/tsocket.c As the POSIX says in: http://pubs.opengroup.org/onlinepubs/9699919799/functions/writev.html the "iovcnt" (3rd arg. of writev/readv) should be in: 0 <= iovcnt <= {IOV_MAX} so the loop counts the index into the field should count up to IOV_MAX - 1 note: 0 means "no vector" -> nothing to transfer
I apologize for the following mistakes: - comment about difference in Solaris man is wrong - both are the same - 0 < iovcnt <= IOV_MAX so 0 <= field_index <= {IOV_MAX - 1}
Hmm. IOV_MAX on Solaris is 16, right? To be honest, I fail to see how tsocket passes "17" down to writev/readv. I think the ">" condition in current master is correct. Posix says "less than or equal to {IOV_MAX}". There are other calls to writev/readv in the code that might not check this correctly. Can you check the precise call stack with dtrace or something? Or explain how tsocket violates the "or equal to {IOV_MAX}" condition?