From owner-svn-src-all@FreeBSD.ORG Wed Nov 20 19:41:01 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 5D16D2A6; Wed, 20 Nov 2013 19:41:01 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4C97A2404; Wed, 20 Nov 2013 19:41:01 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rAKJf1F2039848; Wed, 20 Nov 2013 19:41:01 GMT (envelope-from kib@svn.freebsd.org) Received: (from kib@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id rAKJf1fI039844; Wed, 20 Nov 2013 19:41:01 GMT (envelope-from kib@svn.freebsd.org) Message-Id: <201311201941.rAKJf1fI039844@svn.freebsd.org> From: Konstantin Belousov Date: Wed, 20 Nov 2013 19:41:01 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r258397 - head/sys/fs/pseudofs X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2013 19:41:01 -0000 Author: kib Date: Wed Nov 20 19:41:00 2013 New Revision: 258397 URL: http://svnweb.freebsd.org/changeset/base/258397 Log: Redo r258088 to avoid relying on signed arithmetic overflow, since compiler interprets this as an undefined behaviour. Instead, ensure that the sum of uio_offset and uio_resid is below OFF_MAX using the operation which cannot overflow. Reported and tested by: pho Discussed with: bde Approved by: des (pseudofs maintainer) Sponsored by: The FreeBSD Foundation MFC after: 1 week Modified: head/sys/fs/pseudofs/pseudofs_vnops.c Modified: head/sys/fs/pseudofs/pseudofs_vnops.c ============================================================================== --- head/sys/fs/pseudofs/pseudofs_vnops.c Wed Nov 20 18:58:07 2013 (r258396) +++ head/sys/fs/pseudofs/pseudofs_vnops.c Wed Nov 20 19:41:00 2013 (r258397) @@ -616,8 +616,7 @@ pfs_read(struct vop_read_args *va) struct proc *proc; struct sbuf *sb = NULL; int error, locked; - off_t offset; - ssize_t buflen, resid; + off_t buflen; PFS_TRACE(("%s", pn->pn_name)); pfs_assert_not_owned(pn); @@ -654,16 +653,12 @@ pfs_read(struct vop_read_args *va) goto ret; } - resid = uio->uio_resid; - offset = uio->uio_offset; - buflen = offset + resid; - - /* beaucoup sanity checks so we don't ask for bogus allocation */ - if (resid < 0 || buflen < offset || buflen < resid || - buflen >= INT_MAX) { + if (uio->uio_resid < 0 || uio->uio_offset < 0 || + uio->uio_resid > OFF_MAX - uio->uio_offset) { error = EINVAL; goto ret; } + buflen = uio->uio_offset + uio->uio_resid; if (buflen > MAXPHYS) buflen = MAXPHYS;