Date: Fri, 20 Mar 2009 11:08:57 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r190145 - head/sys/kern Message-ID: <200903201108.n2KB8vHN000502@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Fri Mar 20 11:08:57 2009 New Revision: 190145 URL: http://svn.freebsd.org/changeset/base/190145 Log: Do not underflow the buffer and then report the problem. Check for the condition before the buffer write. Also, since buflen is unsigned, previous check was ignored. Reviewed by: marcus Tested by: pho Modified: head/sys/kern/vfs_cache.c Modified: head/sys/kern/vfs_cache.c ============================================================================== --- head/sys/kern/vfs_cache.c Fri Mar 20 11:03:55 2009 (r190144) +++ head/sys/kern/vfs_cache.c Fri Mar 20 11:08:57 2009 (r190145) @@ -970,13 +970,13 @@ vn_fullpath1(struct thread *td, struct v if (error) return (error); } - *--bp = '/'; - buflen--; - if (buflen < 0) { + if (buflen <= 0) { numfullpathfail4++; CACHE_RUNLOCK(); return (ENOMEM); } + *--bp = '/'; + buflen--; slash_prefixed = 1; } while (vp != rdir && vp != rootvnode) { @@ -1013,14 +1013,14 @@ vn_fullpath1(struct thread *td, struct v if (error) break; } - *--bp = '/'; - buflen--; - if (buflen < 0) { + if (buflen <= 0) { numfullpathfail4++; CACHE_RUNLOCK(); error = ENOMEM; break; } + *--bp = '/'; + buflen--; slash_prefixed = 1; } if (error)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903201108.n2KB8vHN000502>