Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 17 Dec 2013 13:10:28 +0000 (UTC)
From:      Konstantin Belousov <kib@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r259506 - stable/10/sys/fs/pseudofs
Message-ID:  <201312171310.rBHDASYK070536@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: kib
Date: Tue Dec 17 13:10:28 2013
New Revision: 259506
URL: http://svnweb.freebsd.org/changeset/base/259506

Log:
  MFC r258088:
  Add check for buflen overflow by comparing the buflen with both offset
  and resid.
  
  MFC r258397:
  Redo r258088 to avoid relying on signed arithmetic overflow.

Modified:
  stable/10/sys/fs/pseudofs/pseudofs_vnops.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/fs/pseudofs/pseudofs_vnops.c
==============================================================================
--- stable/10/sys/fs/pseudofs/pseudofs_vnops.c	Tue Dec 17 13:02:23 2013	(r259505)
+++ stable/10/sys/fs/pseudofs/pseudofs_vnops.c	Tue Dec 17 13:10:28 2013	(r259506)
@@ -616,8 +616,7 @@ pfs_read(struct vop_read_args *va)
 	struct proc *proc;
 	struct sbuf *sb = NULL;
 	int error, locked;
-	off_t offset;
-	ssize_t buflen, resid;
+	off_t buflen;
 
 	PFS_TRACE(("%s", pn->pn_name));
 	pfs_assert_not_owned(pn);
@@ -654,14 +653,12 @@ pfs_read(struct vop_read_args *va)
 		goto ret;
 	}
 
-	/* beaucoup sanity checks so we don't ask for bogus allocation */
-	if (uio->uio_offset < 0 || uio->uio_resid < 0 ||
-	    (offset = uio->uio_offset) != uio->uio_offset ||
-	    (resid = uio->uio_resid) != uio->uio_resid ||
-	    (buflen = offset + resid) < offset || buflen >= INT_MAX) {
+	if (uio->uio_resid < 0 || uio->uio_offset < 0 ||
+	    uio->uio_resid > OFF_MAX - uio->uio_offset) {
 		error = EINVAL;
 		goto ret;
 	}
+	buflen = uio->uio_offset + uio->uio_resid;
 	if (buflen > MAXPHYS)
 		buflen = MAXPHYS;
 



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312171310.rBHDASYK070536>