From 40d11520598ed930ffc0866e9948d94b090f4062 Mon Sep 17 00:00:00 2001
From: Matthias Andree <matthias.andree@gmx.de>
Date: Sat, 31 Jan 2026 23:25:33 +0100
Subject: [PATCH] read_writev: avoid reading past the last iovec elem

If iovcnt is exhausted and the first vector element's operation
is satisfied, the while loop will read past the end of the
iovec array.  This triggers the address sanitizer and leads to
undefined program state.  Avoid reading too far.
---
 src/util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/util.c b/src/util.c
index 75971d3..59be5d7 100644
--- a/src/util.c
+++ b/src/util.c
@@ -790,7 +790,7 @@ int read_writev(int fd, struct iovec *iov, int iovcnt, int rw)
 	return 0;
       
       done += n;
-      while ((size_t)done >= iov[cur].iov_len)
+      while (cur < iovcnt && (size_t)done >= iov[cur].iov_len)
 	done -= iov[cur++].iov_len;
     }