https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264468
Mark Johnston <ma...@freebsd.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|New |Open
CC| |ma...@freebsd.org
--- Comment #1 from Mark Johnston <ma...@freebsd.org> ---
In all three cases, orig_buf_size and buffer_size are unsigned. So in the
comparison "orig_buf_size < buffer_size - sizeof(struct protoent) - sizeof(char
*)", if underflow occurs, the right-hand side will wrap around to a large value
and the comparison will evaluate to true, causing __proto_unmarshal_func() to
return an error. Also note that "buffer_size" is directly set by the caller,
the generic NSS cache code starts the buffer size at
NSS_CACHE_BUFFER_INITIAL_SIZE (1KB) and grows it. So, I don't quite see the
problem here - can you explain further?
BTW, the attached patch does not seem to compile.
--
You are receiving this mail because:
You are the assignee for the bug.
