Date: Tue, 17 Dec 2013 13:10:28 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r259506 - stable/10/sys/fs/pseudofs Message-ID: <201312171310.rBHDASYK070536@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Tue Dec 17 13:10:28 2013 New Revision: 259506 URL: http://svnweb.freebsd.org/changeset/base/259506 Log: MFC r258088: Add check for buflen overflow by comparing the buflen with both offset and resid. MFC r258397: Redo r258088 to avoid relying on signed arithmetic overflow. Modified: stable/10/sys/fs/pseudofs/pseudofs_vnops.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/fs/pseudofs/pseudofs_vnops.c ============================================================================== --- stable/10/sys/fs/pseudofs/pseudofs_vnops.c Tue Dec 17 13:02:23 2013 (r259505) +++ stable/10/sys/fs/pseudofs/pseudofs_vnops.c Tue Dec 17 13:10:28 2013 (r259506) @@ -616,8 +616,7 @@ pfs_read(struct vop_read_args *va) struct proc *proc; struct sbuf *sb = NULL; int error, locked; - off_t offset; - ssize_t buflen, resid; + off_t buflen; PFS_TRACE(("%s", pn->pn_name)); pfs_assert_not_owned(pn); @@ -654,14 +653,12 @@ pfs_read(struct vop_read_args *va) goto ret; } - /* beaucoup sanity checks so we don't ask for bogus allocation */ - if (uio->uio_offset < 0 || uio->uio_resid < 0 || - (offset = uio->uio_offset) != uio->uio_offset || - (resid = uio->uio_resid) != uio->uio_resid || - (buflen = offset + resid) < offset || buflen >= INT_MAX) { + if (uio->uio_resid < 0 || uio->uio_offset < 0 || + uio->uio_resid > OFF_MAX - uio->uio_offset) { error = EINVAL; goto ret; } + buflen = uio->uio_offset + uio->uio_resid; if (buflen > MAXPHYS) buflen = MAXPHYS;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312171310.rBHDASYK070536>