doc/share/security/patches/SA-03:16/filedesc.patch

56 lines
1.6 KiB
Diff
Raw Normal View History

Index: sys/kern/sys_generic.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/sys_generic.c,v
retrieving revision 1.55.2.10
diff -c -r1.55.2.10 sys_generic.c
*** sys/kern/sys_generic.c 17 Mar 2001 10:39:32 -0000 1.55.2.10
--- sys/kern/sys_generic.c 23 Sep 2003 17:52:41 -0000
***************
*** 231,237 ****
register struct filedesc *fdp = p->p_fd;
struct uio auio;
register struct iovec *iov;
! struct iovec *needfree;
struct iovec aiov[UIO_SMALLIOV];
long i, cnt, error = 0;
u_int iovlen;
--- 231,237 ----
register struct filedesc *fdp = p->p_fd;
struct uio auio;
register struct iovec *iov;
! struct iovec *needfree = NULL;
struct iovec aiov[UIO_SMALLIOV];
long i, cnt, error = 0;
u_int iovlen;
***************
*** 245,258 ****
/* note: can't use iovlen until iovcnt is validated */
iovlen = uap->iovcnt * sizeof (struct iovec);
if (uap->iovcnt > UIO_SMALLIOV) {
! if (uap->iovcnt > UIO_MAXIOV)
! return (EINVAL);
MALLOC(iov, struct iovec *, iovlen, M_IOV, M_WAITOK);
needfree = iov;
! } else {
iov = aiov;
- needfree = NULL;
- }
auio.uio_iov = iov;
auio.uio_iovcnt = uap->iovcnt;
auio.uio_rw = UIO_READ;
--- 245,258 ----
/* note: can't use iovlen until iovcnt is validated */
iovlen = uap->iovcnt * sizeof (struct iovec);
if (uap->iovcnt > UIO_SMALLIOV) {
! if (uap->iovcnt > UIO_MAXIOV) {
! error = EINVAL;
! goto done;
! }
MALLOC(iov, struct iovec *, iovlen, M_IOV, M_WAITOK);
needfree = iov;
! } else
iov = aiov;
auio.uio_iov = iov;
auio.uio_iovcnt = uap->iovcnt;
auio.uio_rw = UIO_READ;