commit 6eb07a178cf613c9648650b6e16604706c4aede4
from: Stefan Sperling <stsp@stsp.name>
date: Sun Nov 04 21:09:59 2018 UTC

fix imsg limit calculation in got_privsep_send_tree()

commit - b00c982167ffc56b444ff3211a2b5a62c56ec589
commit + 6eb07a178cf613c9648650b6e16604706c4aede4
blob - 24bc13c17a4bac288c81125e4564e661ca7d4fd6
blob + 2429a9462a3a8c43c3d457557c231213747aec54
--- lib/privsep.c
+++ lib/privsep.c
@@ -627,6 +627,7 @@ got_privsep_send_tree(struct imsgbuf *ibuf, struct got
 	struct got_imsg_tree_object itree;
 	struct got_tree_entry *te;
 	size_t totlen;
+	int nimsg; /* number of imsg queued in ibuf */
 
 	itree.nentries = tree->entries.nentries;
 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
@@ -634,6 +635,7 @@ got_privsep_send_tree(struct imsgbuf *ibuf, struct got
 		return got_error_from_errno();
 
 	totlen = sizeof(itree);
+	nimsg = 1;
 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
 		struct got_imsg_tree_entry ite;
 		uint8_t *buf = NULL;
@@ -642,10 +644,12 @@ got_privsep_send_tree(struct imsgbuf *ibuf, struct got
 		if (len > MAX_IMSGSIZE)
 			return got_error(GOT_ERR_NO_SPACE);
 
-		if (totlen + len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
+		nimsg++;
+		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
 			err = flush_imsg(ibuf);
 			if (err)
 				return err;
+			nimsg = 0;
 		}
 
 		buf = malloc(len);