101 lines
2.8 KiB
Diff
101 lines
2.8 KiB
Diff
--- sys/compat/svr4/svr4_misc.c.orig
|
|
+++ sys/compat/svr4/svr4_misc.c
|
|
@@ -260,6 +260,7 @@
|
|
u_long *cookies = NULL, *cookiep;
|
|
int ncookies;
|
|
|
|
+ memset(&svr4_dirent, 0, sizeof(svr4_dirent));
|
|
DPRINTF(("svr4_sys_getdents64(%d, *, %d)\n",
|
|
uap->fd, uap->nbytes));
|
|
error = getvnode(td->td_proc->p_fd, uap->fd,
|
|
--- sys/dev/drm/drm_bufs.c.orig
|
|
+++ sys/dev/drm/drm_bufs.c
|
|
@@ -935,6 +935,7 @@
|
|
if (dma->bufs[i].buf_count) {
|
|
struct drm_buf_desc from;
|
|
|
|
+ memset(&from, 0, sizeof(from));
|
|
from.count = dma->bufs[i].buf_count;
|
|
from.size = dma->bufs[i].buf_size;
|
|
from.low_mark = dma->bufs[i].freelist.low_mark;
|
|
--- sys/dev/drm/drm_irq.c.orig
|
|
+++ sys/dev/drm/drm_irq.c
|
|
@@ -357,7 +357,7 @@
|
|
goto out;
|
|
|
|
crtc = modeset->crtc;
|
|
- if (crtc >= dev->num_crtcs) {
|
|
+ if (crtc < 0 || crtc >= dev->num_crtcs) {
|
|
ret = EINVAL;
|
|
goto out;
|
|
}
|
|
--- sys/dev/hpt27xx/hpt27xx_osm_bsd.c.orig
|
|
+++ sys/dev/hpt27xx/hpt27xx_osm_bsd.c
|
|
@@ -1402,7 +1402,7 @@
|
|
{
|
|
PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
|
|
IOCTL_ARG ioctl_args;
|
|
- HPT_U32 bytesReturned;
|
|
+ HPT_U32 bytesReturned = 0;
|
|
|
|
switch (cmd){
|
|
case HPT_DO_IOCONTROL:
|
|
@@ -1432,7 +1432,7 @@
|
|
}
|
|
|
|
if (ioctl_args.nOutBufferSize) {
|
|
- ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
|
|
+ ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK | M_ZERO);
|
|
if (!ioctl_args.lpOutBuffer)
|
|
goto invalid;
|
|
}
|
|
--- sys/dev/hptnr/hptnr_osm_bsd.c.orig
|
|
+++ sys/dev/hptnr/hptnr_osm_bsd.c
|
|
@@ -1584,7 +1584,7 @@
|
|
{
|
|
PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
|
|
IOCTL_ARG ioctl_args;
|
|
- HPT_U32 bytesReturned;
|
|
+ HPT_U32 bytesReturned = 0;
|
|
|
|
switch (cmd){
|
|
case HPT_DO_IOCONTROL:
|
|
@@ -1614,7 +1614,7 @@
|
|
}
|
|
|
|
if (ioctl_args.nOutBufferSize) {
|
|
- ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
|
|
+ ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK | M_ZERO);
|
|
if (!ioctl_args.lpOutBuffer)
|
|
goto invalid;
|
|
}
|
|
--- sys/dev/hptrr/hptrr_osm_bsd.c.orig
|
|
+++ sys/dev/hptrr/hptrr_osm_bsd.c
|
|
@@ -1231,7 +1231,7 @@
|
|
{
|
|
PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
|
|
IOCTL_ARG ioctl_args;
|
|
- HPT_U32 bytesReturned;
|
|
+ HPT_U32 bytesReturned = 0;
|
|
|
|
switch (cmd){
|
|
case HPT_DO_IOCONTROL:
|
|
@@ -1261,7 +1261,7 @@
|
|
}
|
|
|
|
if (ioctl_args.nOutBufferSize) {
|
|
- ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
|
|
+ ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK | M_ZERO);
|
|
if (!ioctl_args.lpOutBuffer)
|
|
goto invalid;
|
|
}
|
|
--- sys/i386/ibcs2/ibcs2_misc.c.orig
|
|
+++ sys/i386/ibcs2/ibcs2_misc.c
|
|
@@ -352,6 +352,7 @@
|
|
#define BSD_DIRENT(cp) ((struct dirent *)(cp))
|
|
#define IBCS2_RECLEN(reclen) (reclen + sizeof(u_short))
|
|
|
|
+ memset(&idb, 0, sizeof(idb));
|
|
error = getvnode(td->td_proc->p_fd, uap->fd,
|
|
cap_rights_init(&rights, CAP_READ), &fp);
|
|
if (error != 0)
|