Author: kib
Date: Wed Nov 20 19:41:00 2013
New Revision: 258397
URL: http://svnweb.freebsd.org/changeset/base/258397
Log:
  Redo r258088 to avoid relying on signed arithmetic overflow, since
  compiler interprets this as an undefined behaviour.  Instead, ensure
  that the sum of uio_offset and uio_resid is below OFF_MAX using the
  operation which cannot overflow.
  
  Reported and tested by:       pho
  Discussed with:       bde
  Approved by:  des (pseudofs maintainer)
  Sponsored by: The FreeBSD Foundation
  MFC after:    1 week

Modified:
  head/sys/fs/pseudofs/pseudofs_vnops.c

Modified: head/sys/fs/pseudofs/pseudofs_vnops.c
==============================================================================
--- head/sys/fs/pseudofs/pseudofs_vnops.c       Wed Nov 20 18:58:07 2013        
(r258396)
+++ head/sys/fs/pseudofs/pseudofs_vnops.c       Wed Nov 20 19:41:00 2013        
(r258397)
@@ -616,8 +616,7 @@ pfs_read(struct vop_read_args *va)
        struct proc *proc;
        struct sbuf *sb = NULL;
        int error, locked;
-       off_t offset;
-       ssize_t buflen, resid;
+       off_t buflen;
 
        PFS_TRACE(("%s", pn->pn_name));
        pfs_assert_not_owned(pn);
@@ -654,16 +653,12 @@ pfs_read(struct vop_read_args *va)
                goto ret;
        }
 
-       resid = uio->uio_resid;
-       offset = uio->uio_offset;
-       buflen = offset + resid;
-
-       /* beaucoup sanity checks so we don't ask for bogus allocation */
-       if (resid < 0 || buflen < offset || buflen < resid ||
-           buflen >= INT_MAX) {
+       if (uio->uio_resid < 0 || uio->uio_offset < 0 ||
+           uio->uio_resid > OFF_MAX - uio->uio_offset) {
                error = EINVAL;
                goto ret;
        }
+       buflen = uio->uio_offset + uio->uio_resid;
        if (buflen > MAXPHYS)
                buflen = MAXPHYS;
 
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to