Below the uiomove() conversion for dev/wscons/wsevent.c. 'cnt' could
as well be a size_t, but using u_int makes clear, that it will never
exceed UINT_MAX, and that 'ev->get = cnt;' won't overflow.
Index: dev/wscons/wsevent.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsevent.c,v
retrieving revision 1.14
diff -u -p -u -r1.14 wsevent.c
--- dev/wscons/wsevent.c 10 Sep 2015 18:14:52 -0000 1.14
+++ dev/wscons/wsevent.c 9 Jan 2016 08:35:55 -0000
@@ -136,7 +136,9 @@ wsevent_fini(struct wseventvar *ev)
int
wsevent_read(struct wseventvar *ev, struct uio *uio, int flags)
{
- int s, n, cnt, error;
+ int s, error;
+ u_int cnt;
+ size_t n;
/*
* Make sure we can return at least 1.
@@ -169,7 +171,7 @@ wsevent_read(struct wseventvar *ev, stru
n = howmany(uio->uio_resid, sizeof(struct wscons_event));
if (cnt > n)
cnt = n;
- error = uiomovei((caddr_t)&ev->q[ev->get],
+ error = uiomove((caddr_t)&ev->q[ev->get],
cnt * sizeof(struct wscons_event), uio);
n -= cnt;
/*
@@ -182,7 +184,7 @@ wsevent_read(struct wseventvar *ev, stru
return (error);
if (cnt > n)
cnt = n;
- error = uiomovei((caddr_t)&ev->q[0],
+ error = uiomove((caddr_t)&ev->q[0],
cnt * sizeof(struct wscons_event), uio);
ev->get = cnt;
return (error);
cheers,
natano
