diff options
| author | nectar <nectar@FreeBSD.org> | 2004-02-10 21:06:47 +0000 |
|---|---|---|
| committer | nectar <nectar@FreeBSD.org> | 2004-02-10 21:06:47 +0000 |
| commit | a96542610a6d885712cc0b71ed39380529d212d6 (patch) | |
| tree | b6295d49c64362a22e64a530a7692f1fef54f9eb /sys/fs | |
| parent | 788d9119de35ce4eeca0918ea8806a5f8baae5ac (diff) | |
| download | FreeBSD-src-a96542610a6d885712cc0b71ed39380529d212d6.zip FreeBSD-src-a96542610a6d885712cc0b71ed39380529d212d6.tar.gz | |
Fix a panic in pseudofs(9) that could occur when doing an I/O
operation with a large request or large offset.
Reported by: Joel Ray Holveck <joelh@piquan.org>
Submitted by: des
Diffstat (limited to 'sys/fs')
| -rw-r--r-- | sys/fs/pseudofs/pseudofs_vnops.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c index 28b1a65..d21145b 100644 --- a/sys/fs/pseudofs/pseudofs_vnops.c +++ b/sys/fs/pseudofs/pseudofs_vnops.c @@ -525,6 +525,11 @@ pfs_read(struct vop_read_args *va) PRELE(proc); PFS_RETURN (EINVAL); } + if (buflen > MAXPHYS) { + if (proc != NULL) + PRELE(proc); + PFS_RETURN (EIO); + } sb = sbuf_new(sb, NULL, buflen, 0); if (sb == NULL) { if (proc != NULL) |
