diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 1999-04-18 18:24:41 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 1999-04-18 18:24:41 +0000 |
| commit | 41f02fc1a13cc7ebe438563b326953348f604f5c (patch) | |
| tree | 1ce7782ae2b4cd7d7fd9121eb12f34af098fdb18 | |
| parent | ee6cd6c8947798995cf07c2b14e16187e6bae69f (diff) | |
incorrect range checking, output buf oflow; futatuki@fureai.or.jp
| -rw-r--r-- | sys/kern/sysv_msg.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c index e1192b18baa..4c3bc097f41 100644 --- a/sys/kern/sysv_msg.c +++ b/sys/kern/sysv_msg.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sysv_msg.c,v 1.6 1999/02/04 18:48:25 deraadt Exp $ */ +/* $OpenBSD: sysv_msg.c,v 1.7 1999/04/18 18:24:40 deraadt Exp $ */ /* $NetBSD: sysv_msg.c,v 1.19 1996/02/09 19:00:18 christos Exp $ */ /* @@ -1127,10 +1127,10 @@ sys_msgrcv(p, v, retval) for (len = 0; len < msgsz; len += msginfo.msgssz) { size_t tlen; - if (msgsz > msginfo.msgssz) + if (msgsz - len > msginfo.msgssz) tlen = msginfo.msgssz; else - tlen = msgsz; + tlen = msgsz - len; #ifdef DIAGNOSTIC if (next <= -1) panic("next too low #3"); |