diff options
| author | allanjude <allanjude@FreeBSD.org> | 2016-01-11 15:35:29 +0000 |
|---|---|---|
| committer | allanjude <allanjude@FreeBSD.org> | 2016-01-11 15:35:29 +0000 |
| commit | 2af23444c6e30ff6f90dc45643cdf1b2295d20d4 (patch) | |
| tree | 0916426712f745f9520bcf2341b67bbb4e90b2c0 /contrib/llvm/lib/CodeGen | |
| parent | 5aea4e36e2be1eb8c7a74e1c40476355128f14e9 (diff) | |
| download | FreeBSD-src-2af23444c6e30ff6f90dc45643cdf1b2295d20d4.zip FreeBSD-src-2af23444c6e30ff6f90dc45643cdf1b2295d20d4.tar.gz | |
DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args
member secsz was a uint16_t
sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a
uint16_t for media sector size; it is used as an argument for ioctl()
at line 484. however, this ioctl writes 32 bits of data (u_int *) and
therefore this ioctl will overwrite and corrupt 16 bits of memory.
other use cases seem to use correct u_int type for secsz.
PR: 204358
Submitted by: Toomas Soome <tsoome at me.com>
Reviewed by: asomers, delphij, smh
MFC after: 5 days
Differential Revision: https://reviews.freebsd.org/D4811
Diffstat (limited to 'contrib/llvm/lib/CodeGen')
0 files changed, 0 insertions, 0 deletions
