upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-04-22 23:02:02 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

{ext2|ufs}_readdir: Avoid setting negative ncookies.

Browse source 
ncookies cannot be negative or the allocator will fail. This should only
happen if a caller is very broken but we can still try to survive the
event.

We should probably also verify for uio_resid > MAXPHYS but in that case
it is not clear that just clipping the ncookies value is an adequate
response.

MFC after:	2 weeks
This commit is contained in:
Pedro F. Giffuni 2018-02-06 22:38:19 +00:00
parent ce75945d3c
commit 7cbd6d338e
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sys/fs/ext2fs/ext2_lookup.c
View file

@ -153,7 +153,10 @@ ext2_readdir(struct vop_readdir_args *ap)
return (EINVAL);
ip = VTOI(vp);
if (ap->a_ncookies != NULL) {
ncookies = uio->uio_resid;
if (uio->uio_resid < 0)
ncookies = 0;
else
ncookies = uio->uio_resid;
if (uio->uio_offset >= ip->i_size)
ncookies = 0;
else if (ip->i_size - uio->uio_offset < ncookies)

5
sys/ufs/ufs/ufs_vnops.c
View file

@ -2179,7 +2179,10 @@ ufs_readdir(ap)
if (ip->i_effnlink == 0)
return (0);
if (ap->a_ncookies != NULL) {
ncookies = uio->uio_resid;
if (uio->uio_resid < 0)
ncookies = 0;
else
ncookies = uio->uio_resid;
if (uio->uio_offset >= ip->i_size)
ncookies = 0;
else if (ip->i_size - uio->uio_offset < ncookies)