bzero() the sigframe before we fill it. This was not done at all in

linux_rt_sendsig() and only done for the fpstate in linux_sendsig().

1 files changed, 4 insertions, 3 deletions

diff --git a/sys/i386/linux/linux_sysvec.c b/sys/i386/linux/linux_sysvec.c
index cad766e..63ff5d7 100644
--- a/sys/i386/linux/linux_sysvec.c
+++ b/sys/i386/linux/linux_sysvec.c
@@ -299,6 +299,8 @@ linux_rt_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 		if (sig <= p->p_sysent->sv_sigsize)
 			sig = p->p_sysent->sv_sigtbl[_SIG_IDX(sig)];
 
+	bzero(&frame, sizeof(frame));
+
 	frame.sf_handler = catcher;
 	frame.sf_sig = sig;
 	frame.sf_siginfo = &fp->sf_si;
@@ -391,7 +393,6 @@ linux_rt_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
  * frame pointer, it returns to the user
  * specified pc, psl.
  */
-
 static void
 linux_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 {
@@ -436,6 +437,8 @@ linux_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 		if (sig <= p->p_sysent->sv_sigsize)
 			sig = p->p_sysent->sv_sigtbl[_SIG_IDX(sig)];
 
+	bzero(&frame, sizeof(frame));
+
 	frame.sf_handler = catcher;
 	frame.sf_sig = sig;
 
@@ -464,8 +467,6 @@ linux_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	frame.sf_sc.sc_err    = regs->tf_err;
 	frame.sf_sc.sc_trapno = bsd_to_linux_trapcode(code);
 
-	bzero(&frame.sf_fpstate, sizeof(struct l_fpstate));
-
 	for (i = 0; i < (LINUX_NSIG_WORDS-1); i++)
 		frame.sf_extramask[i] = lmask.__bits[i+1];