ipc: recv_cmd4 clobbers destination buffer on errors

Handling this should be done at the lowest levels possible;
so away from higher-level lei code.

1 files changed, 5 insertions, 3 deletions

diff --git a/lib/PublicInbox/Spawn.pm b/lib/PublicInbox/Spawn.pm
index ed698afc..2b84e2d5 100644
--- a/lib/PublicInbox/Spawn.pm
+++ b/lib/PublicInbox/Spawn.pm
@@ -259,10 +259,12 @@ void recv_cmd4(PerlIO *s, SV *buf, STRLEN n)
         msg.msg_controllen = CMSG_SPACE(SEND_FD_SPACE);
 
         i = recvmsg(PerlIO_fileno(s), &msg, 0);
-        if (i < 0)
-                Inline_Stack_Push(&PL_sv_undef);
-        else
+        if (i >= 0) {
                 SvCUR_set(buf, i);
+        } else {
+                Inline_Stack_Push(&PL_sv_undef);
+                SvCUR_set(buf, 0);
+        }
         if (i > 0 && cmsg.hdr.cmsg_level == SOL_SOCKET &&
                         cmsg.hdr.cmsg_type == SCM_RIGHTS) {
                 size_t len = cmsg.hdr.cmsg_len;