From 40d9f8a709fed270c8aeea9be4980229e7fdccf0 Mon Sep 17 00:00:00 2001
From: jdolecek <jdolecek@NetBSD.org>
Date: Sat, 22 Apr 2000 22:45:37 +0000
Subject: [PATCH] msdosfs_read(): avoid integer overflow for files > 2GB,  when
 	difference between current read position and file size 	is bigger than
 2GB

This fixes problem first noted in FreeBSD PR#15639 and sent
by Martin J. Laubach in kern/9046, though the implementation
differs a bit.
---
 sys/msdosfs/msdosfs_vnops.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sys/msdosfs/msdosfs_vnops.c b/sys/msdosfs/msdosfs_vnops.c
index 3cca3b967796..cb5131d80078 100644
--- a/sys/msdosfs/msdosfs_vnops.c
+++ b/sys/msdosfs/msdosfs_vnops.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: msdosfs_vnops.c,v 1.95 2000/03/30 12:23:20 augustss Exp $	*/
+/*	$NetBSD: msdosfs_vnops.c,v 1.96 2000/04/22 22:45:37 jdolecek Exp $	*/
 
 /*-
  * Copyright (C) 1994, 1995, 1997 Wolfgang Solfrank.
@@ -466,7 +466,7 @@ msdosfs_read(v)
 		struct ucred *a_cred;
 	} */ *ap = v;
 	int error = 0;
-	int diff;
+	int64_t diff;
 	int blsize;
 	int isadir;
 	long n;
@@ -492,11 +492,12 @@ msdosfs_read(v)
 		lbn = de_cluster(pmp, uio->uio_offset);
 		on = uio->uio_offset & pmp->pm_crbomask;
 		n = min((u_long) (pmp->pm_bpcluster - on), uio->uio_resid);
-		diff = dep->de_FileSize - uio->uio_offset;
-		if (diff <= 0)
+		if (uio->uio_offset >= dep->de_FileSize)
 			return (0);
+		/* file size (and hence diff) may be up to 4GB */
+		diff = dep->de_FileSize - uio->uio_offset;
 		if (diff < n)
-			n = diff;
+			n = (long) diff;
 		/* convert cluster # to block # if a directory */
 		if (isadir) {
 			error = pcbmap(dep, lbn, &lbn, 0, &blsize);