From af4e8e9ea7159342b9057ef1a34cf99564c49afd Mon Sep 17 00:00:00 2001
From: rmind <rmind@NetBSD.org>
Date: Wed, 4 Jun 2008 13:02:41 +0000
Subject: [PATCH] Check the result of allocation in the cases where size is
 passed by user.

---
 sys/kern/sys_select.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/sys/kern/sys_select.c b/sys/kern/sys_select.c
index 60e0db6f095c..a3ccb3fe5f0d 100644
--- a/sys/kern/sys_select.c
+++ b/sys/kern/sys_select.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sys_select.c,v 1.8 2008/05/26 12:08:39 ad Exp $	*/
+/*	$NetBSD: sys_select.c,v 1.9 2008/06/04 13:02:41 rmind Exp $	*/
 
 /*-
  * Copyright (c) 2007, 2008 The NetBSD Foundation, Inc.
@@ -70,7 +70,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_select.c,v 1.8 2008/05/26 12:08:39 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_select.c,v 1.9 2008/06/04 13:02:41 rmind Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -232,9 +232,11 @@ selcommon(lwp_t *l, register_t *retval, int nd, fd_set *u_in,
 		nd = p->p_fd->fd_nfiles;
 	}
 	ni = howmany(nd, NFDBITS) * sizeof(fd_mask);
-	if (ni * 6 > sizeof(smallbits))
+	if (ni * 6 > sizeof(smallbits)) {
 		bits = kmem_alloc(ni * 6, KM_SLEEP);
-	else
+		if (bits == NULL)
+			return ENOMEM;
+	} else
 		bits = smallbits;
 
 #define	getbits(name, x)						\
@@ -435,9 +437,11 @@ pollcommon(lwp_t *l, register_t *retval,
 		nfds = p->p_fd->fd_nfiles;
 	}
 	ni = nfds * sizeof(struct pollfd);
-	if (ni > sizeof(smallbits))
+	if (ni > sizeof(smallbits)) {
 		bits = kmem_alloc(ni, KM_SLEEP);
-	else
+		if (bits == NULL)
+			return ENOMEM;
+	} else
 		bits = smallbits;
 
 	error = copyin(u_fds, bits, ni);