diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2004-09-01 21:06:18 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2004-09-01 21:06:18 +0000 |
| commit | 78d64dde09718e229b6bdd6f7c53c20dd8961ad5 (patch) | |
| tree | 1edef361f1d85dd47020b1e7a20d5bfd02501829 | |
| parent | e35d15441ce31453652911ab1c3ea834189fa7b7 (diff) | |
Make sure we don't call kernfs_xread() with a negative offset.
Problem found by Christer Oberg. OK henning@, deraadt@
| -rw-r--r-- | sys/miscfs/kernfs/kernfs_vnops.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/sys/miscfs/kernfs/kernfs_vnops.c b/sys/miscfs/kernfs/kernfs_vnops.c index e8e71c4fdc2..cc7cf3080fb 100644 --- a/sys/miscfs/kernfs/kernfs_vnops.c +++ b/sys/miscfs/kernfs/kernfs_vnops.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kernfs_vnops.c,v 1.40 2004/06/24 19:35:24 tholo Exp $ */ +/* $OpenBSD: kernfs_vnops.c,v 1.41 2004/09/01 21:06:17 millert Exp $ */ /* $NetBSD: kernfs_vnops.c,v 1.43 1996/03/16 23:52:47 christos Exp $ */ /* @@ -632,8 +632,11 @@ kernfs_getattr(v) vap->va_fileid = 3 + (kt - kern_targets); total = 0; while (buf = strbuf, - nbytes = kernfs_xread(kt, total, &buf, sizeof(strbuf))) + nbytes = kernfs_xread(kt, total, &buf, sizeof(strbuf))) { + if (total <= INT_MAX - nbytes) + break; /* XXX - should use quad */ total += nbytes; + } vap->va_size = total; } @@ -702,7 +705,8 @@ kernfs_read(v) len = kernfs_xread(kt, off, &buf, sizeof(strbuf))) { if ((error = uiomove(buf, len, uio)) != 0) return (error); - off += len; + if (off <= INT_MAX - len) + off += len; /* XXX - should use quad */ } return (0); } |