Author: kib
Date: Tue Dec 17 13:13:02 2013
New Revision: 259507
URL: http://svnweb.freebsd.org/changeset/base/259507
Log:
MFC r258088:
Add check for buflen overflow by comparing the buflen with both offset
and resid.
MFC r258397:
Redo r258088 to avoid relying on signed arithmetic overflow.
Modified:
stable/9/sys/fs/pseudofs/pseudofs_vnops.c
Directory Properties:
stable/9/sys/ (props changed)
stable/9/sys/fs/ (props changed)
Modified: stable/9/sys/fs/pseudofs/pseudofs_vnops.c
==============================================================================
--- stable/9/sys/fs/pseudofs/pseudofs_vnops.c Tue Dec 17 13:10:28 2013
(r259506)
+++ stable/9/sys/fs/pseudofs/pseudofs_vnops.c Tue Dec 17 13:13:02 2013
(r259507)
@@ -616,8 +616,7 @@ pfs_read(struct vop_read_args *va)
struct proc *proc;
struct sbuf *sb = NULL;
int error, locked;
- off_t offset;
- ssize_t buflen, resid;
+ off_t buflen;
PFS_TRACE(("%s", pn->pn_name));
pfs_assert_not_owned(pn);
@@ -654,14 +653,12 @@ pfs_read(struct vop_read_args *va)
goto ret;
}
- /* beaucoup sanity checks so we don't ask for bogus allocation */
- if (uio->uio_offset < 0 || uio->uio_resid < 0 ||
- (offset = uio->uio_offset) != uio->uio_offset ||
- (resid = uio->uio_resid) != uio->uio_resid ||
- (buflen = offset + resid) < offset || buflen >= INT_MAX) {
+ if (uio->uio_resid < 0 || uio->uio_offset < 0 ||
+ uio->uio_resid > OFF_MAX - uio->uio_offset) {
error = EINVAL;
goto ret;
}
+ buflen = uio->uio_offset + uio->uio_resid;
if (buflen > MAXPHYS)
buflen = MAXPHYS;
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "[email protected]"
