diff options
| author | sada <sada@FreeBSD.org> | 1999-04-21 13:30:01 +0000 |
|---|---|---|
| committer | sada <sada@FreeBSD.org> | 1999-04-21 13:30:01 +0000 |
| commit | b77bb336f91d563c94043b1d50ae78da2d23490c (patch) | |
| tree | 755c5d8cf8024ace8907db0307726931055f6064 | |
| parent | 9b64807a87c76bb3c2bd53d4138cba2f24809603 (diff) | |
| download | FreeBSD-src-b77bb336f91d563c94043b1d50ae78da2d23490c.zip FreeBSD-src-b77bb336f91d563c94043b1d50ae78da2d23490c.tar.gz | |
The function msgrcv() could copy larger data than it should do
under some circumstances.
PR: kern/10765
Submitted by: Yasuhito FUTATSUKI <futatuki@fureai.or.jp>
| -rw-r--r-- | sys/kern/sysv_msg.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c index 8b010b5..334bbf4 100644 --- a/sys/kern/sysv_msg.c +++ b/sys/kern/sysv_msg.c @@ -1,4 +1,4 @@ -/* $Id: sysv_msg.c,v 1.18 1998/03/30 09:50:35 phk Exp $ */ +/* $Id: sysv_msg.c,v 1.19 1999/01/30 12:21:48 phk Exp $ */ /* * Implementation of SVID messages @@ -996,10 +996,10 @@ msgrcv(p, uap) for (len = 0; len < msgsz; len += msginfo.msgssz) { size_t tlen; - if (msgsz > msginfo.msgssz) + if (msgsz - len > msginfo.msgssz) tlen = msginfo.msgssz; else - tlen = msgsz; + tlen = msgsz - len; if (next <= -1) panic("next too low #3"); if (next >= msginfo.msgseg) |
