Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Large values of sb_max would cause an overflow in sbreserve(); cast to

Browse Source 
u_quad_t to avoid this.  (from FreeBSD uipc_socket2.c v1.19)
This commit is contained in:
kml 2001-04-30 03:32:56 +00:00
parent c6a7588b36
commit fc1ebff2b2
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/kern/uipc_socket2.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: uipc_socket2.c,v 1.37 2001/02/27 05:19:15 lukem Exp $ */ /* $NetBSD: uipc_socket2.c,v 1.38 2001/04/30 03:32:56 kml Exp $ */
/* /*
* Copyright (c) 1982, 1986, 1988, 1990, 1993 * Copyright (c) 1982, 1986, 1988, 1990, 1993
@ -375,7 +375,8 @@ int
sbreserve(struct sockbuf *sb, u_long cc) sbreserve(struct sockbuf *sb, u_long cc)
{ {
if (cc == 0 || cc > sb_max * MCLBYTES / (MSIZE + MCLBYTES)) if (cc == 0 ||
(u_quad_t) cc > (u_quad_t) sb_max * MCLBYTES / (MSIZE + MCLBYTES))
return (0); return (0);
sb->sb_hiwat = cc; sb->sb_hiwat = cc;
sb->sb_mbmax = min(cc * 2, sb_max); sb->sb_mbmax = min(cc * 2, sb_max);