diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2008-10-09 16:00:08 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2008-10-09 16:00:08 +0000 |
| commit | 5c38636e40215dcc90f390ee647e46409b3273f2 (patch) | |
| tree | 48e0a0a6c670a40df8f73e4dfe06b294d0f8a68e | |
| parent | 4a28c84a91ac850d319f31b2f3e46643aca3a368 (diff) | |
Change sb_timeo to unsigned, so that even if some calculation (ie. n * HZ)
becomes a very large number it will not wrap the short into a negative
number and screw up timeouts. It will simply become a max of 65535. Since
this happens when HZ is cranked to a high number, this will still only take
n seconds, or less. Safer than crashing.
Prompted by PR 5511
ok guenther
| -rw-r--r-- | sys/kern/uipc_socket.c | 6 | ||||
| -rw-r--r-- | sys/sys/socketvar.h | 4 |
2 files changed, 5 insertions, 5 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 281987c12c2..dd1ad2ddce8 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_socket.c,v 1.72 2008/08/07 17:43:37 reyk Exp $ */ +/* $OpenBSD: uipc_socket.c,v 1.73 2008/10/09 16:00:05 deraadt Exp $ */ /* $NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $ */ /* @@ -1070,14 +1070,14 @@ sosetopt(struct socket *so, int level, int optname, struct mbuf *m0) case SO_RCVTIMEO: { struct timeval *tv; - short val; + u_short val; if (m == NULL || m->m_len < sizeof (*tv)) { error = EINVAL; goto bad; } tv = mtod(m, struct timeval *); - if (tv->tv_sec > (SHRT_MAX - tv->tv_usec / tick) / hz) { + if (tv->tv_sec > (USHRT_MAX - tv->tv_usec / tick) / hz) { error = EDOM; goto bad; } diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h index cdbe4029597..632e15beb4e 100644 --- a/sys/sys/socketvar.h +++ b/sys/sys/socketvar.h @@ -1,4 +1,4 @@ -/* $OpenBSD: socketvar.h,v 1.41 2008/05/23 15:51:12 thib Exp $ */ +/* $OpenBSD: socketvar.h,v 1.42 2008/10/09 16:00:07 deraadt Exp $ */ /* $NetBSD: socketvar.h,v 1.18 1996/02/09 18:25:38 christos Exp $ */ /*- @@ -91,7 +91,7 @@ struct socket { socket buffer */ struct selinfo sb_sel; /* process selecting read/write */ short sb_flags; /* flags, see below */ - short sb_timeo; /* timeout for read/write */ + u_short sb_timeo; /* timeout for read/write */ } so_rcv, so_snd; #define SB_MAX (256*1024) /* default for max chars in sockbuf */ #define SB_LOCK 0x01 /* lock on data queue */ |