diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2011-01-04 15:24:12 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2011-01-04 15:24:12 +0000 |
| commit | 13e70629a2811ea2d48f03d5e8a848ca7dba8283 (patch) | |
| tree | e2fbbcdebc3e6065249456c5ab32f3822556ea31 | |
| parent | c147011b715e7dde6b3a9ae1068d410571c23e73 (diff) | |
in bpf_movein(), range-check mbuf size against MCLBYTES before
size_t to int truncation
ok claudio
| -rw-r--r-- | sys/net/bpf.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/net/bpf.c b/sys/net/bpf.c index 63891e8061e..051f41cf801 100644 --- a/sys/net/bpf.c +++ b/sys/net/bpf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bpf.c,v 1.76 2010/09/21 04:06:37 henning Exp $ */ +/* $OpenBSD: bpf.c,v 1.77 2011/01/04 15:24:11 deraadt Exp $ */ /* $NetBSD: bpf.c,v 1.33 1997/02/21 23:59:35 thorpej Exp $ */ /* @@ -184,9 +184,9 @@ bpf_movein(struct uio *uio, u_int linktype, struct mbuf **mp, return (EIO); } - len = uio->uio_resid; - if (len > MCLBYTES) + if (uio->uio_resid > MCLBYTES) return (EIO); + len = uio->uio_resid; MGETHDR(m, M_WAIT, MT_DATA); m->m_pkthdr.rcvif = 0; |