Check the result of allocation in the cases where size is passed by user.

This commit is contained in:
rmind 2008-06-04 13:02:41 +00:00
parent e7fbdbbaf0
commit af4e8e9ea7
1 changed files with 10 additions and 6 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: sys_select.c,v 1.8 2008/05/26 12:08:39 ad Exp $ */
/* $NetBSD: sys_select.c,v 1.9 2008/06/04 13:02:41 rmind Exp $ */
/*-
* Copyright (c) 2007, 2008 The NetBSD Foundation, Inc.
@ -70,7 +70,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sys_select.c,v 1.8 2008/05/26 12:08:39 ad Exp $");
__KERNEL_RCSID(0, "$NetBSD: sys_select.c,v 1.9 2008/06/04 13:02:41 rmind Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -232,9 +232,11 @@ selcommon(lwp_t *l, register_t *retval, int nd, fd_set *u_in,
nd = p->p_fd->fd_nfiles;
}
ni = howmany(nd, NFDBITS) * sizeof(fd_mask);
if (ni * 6 > sizeof(smallbits))
if (ni * 6 > sizeof(smallbits)) {
bits = kmem_alloc(ni * 6, KM_SLEEP);
else
if (bits == NULL)
return ENOMEM;
} else
bits = smallbits;
#define getbits(name, x) \
@ -435,9 +437,11 @@ pollcommon(lwp_t *l, register_t *retval,
nfds = p->p_fd->fd_nfiles;
}
ni = nfds * sizeof(struct pollfd);
if (ni > sizeof(smallbits))
if (ni > sizeof(smallbits)) {
bits = kmem_alloc(ni, KM_SLEEP);
else
if (bits == NULL)
return ENOMEM;
} else
bits = smallbits;
error = copyin(u_fds, bits, ni);