diff options
| author | eivind <eivind@FreeBSD.org> | 1998-12-16 00:10:51 +0000 |
|---|---|---|
| committer | eivind <eivind@FreeBSD.org> | 1998-12-16 00:10:51 +0000 |
| commit | f1509aea9496162d4bf1269f7a00e0bbb2119c78 (patch) | |
| tree | aa1c5f685298ddcb0ad7f9115bcda93bbd887a3b | |
| parent | 3a5b7248f8119ef593f71948e674d802dd7ca853 (diff) | |
| download | FreeBSD-src-f1509aea9496162d4bf1269f7a00e0bbb2119c78.zip FreeBSD-src-f1509aea9496162d4bf1269f7a00e0bbb2119c78.tar.gz | |
Fix possible NULL-pointer deref in error case (same as DEVFS).
| -rw-r--r-- | sys/fs/specfs/spec_vnops.c | 4 | ||||
| -rw-r--r-- | sys/miscfs/specfs/spec_vnops.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/sys/fs/specfs/spec_vnops.c b/sys/fs/specfs/spec_vnops.c index f0914c3..ff0f347 100644 --- a/sys/fs/specfs/spec_vnops.c +++ b/sys/fs/specfs/spec_vnops.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)spec_vnops.c 8.14 (Berkeley) 5/21/95 - * $Id: spec_vnops.c,v 1.76 1998/10/31 15:31:24 peter Exp $ + * $Id: spec_vnops.c,v 1.77 1998/12/07 21:58:33 archie Exp $ */ #include <sys/param.h> @@ -379,11 +379,11 @@ spec_write(ap) bp = getblk(vp, bn, bsize, 0, 0); else error = bread(vp, bn, bsize, NOCRED, &bp); - n = min(n, bsize - bp->b_resid); if (error) { brelse(bp); return (error); } + n = min(n, bsize - bp->b_resid); error = uiomove((char *)bp->b_data + on, n, uio); if (n + on == bsize) bawrite(bp); diff --git a/sys/miscfs/specfs/spec_vnops.c b/sys/miscfs/specfs/spec_vnops.c index f0914c3..ff0f347 100644 --- a/sys/miscfs/specfs/spec_vnops.c +++ b/sys/miscfs/specfs/spec_vnops.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)spec_vnops.c 8.14 (Berkeley) 5/21/95 - * $Id: spec_vnops.c,v 1.76 1998/10/31 15:31:24 peter Exp $ + * $Id: spec_vnops.c,v 1.77 1998/12/07 21:58:33 archie Exp $ */ #include <sys/param.h> @@ -379,11 +379,11 @@ spec_write(ap) bp = getblk(vp, bn, bsize, 0, 0); else error = bread(vp, bn, bsize, NOCRED, &bp); - n = min(n, bsize - bp->b_resid); if (error) { brelse(bp); return (error); } + n = min(n, bsize - bp->b_resid); error = uiomove((char *)bp->b_data + on, n, uio); if (n + on == bsize) bawrite(bp); |
