c4d9a19be3
transmission which could be tricked into rounding up to the nearest page size, leaking up to a page of kernel memory. [13:11] In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather than pass them on to the link layer without validation or credential checks. [SA-13:12] Prevent cross-mount hardlinks between different nullfs mounts of the same underlying filesystem. [SA-13:13] Security: CVE-2013-5666 Security: FreeBSD-SA-13:11.sendfile Security: CVE-2013-5691 Security: FreeBSD-SA-13:12.ifioctl Security: CVE-2013-5710 Security: FreeBSD-SA-13:13.nullfs Approved by: so
20 lines
686 B
Diff
20 lines
686 B
Diff
Index: sys/kern/uipc_syscalls.c
|
|
===================================================================
|
|
--- sys/kern/uipc_syscalls.c (revision 255414)
|
|
+++ sys/kern/uipc_syscalls.c (working copy)
|
|
@@ -2126,11 +2126,10 @@
|
|
* or the passed in nbytes.
|
|
*/
|
|
pgoff = (vm_offset_t)(off & PAGE_MASK);
|
|
- if (uap->nbytes)
|
|
- rem = (uap->nbytes - fsbytes - loopbytes);
|
|
- else
|
|
- rem = va.va_size -
|
|
- uap->offset - fsbytes - loopbytes;
|
|
+ rem = va.va_size - uap->offset;
|
|
+ if (uap->nbytes != 0)
|
|
+ rem = omin(rem, uap->nbytes);
|
|
+ rem -= fsbytes + loopbytes;
|
|
xfsize = omin(PAGE_SIZE - pgoff, rem);
|
|
xfsize = omin(space - loopbytes, xfsize);
|
|
if (xfsize <= 0) {
|