summaryrefslogtreecommitdiffstats
path: root/sys/kern/sysv_msg.c
diff options
context:
space:
mode:
authorsada <sada@FreeBSD.org>1999-04-21 13:30:01 +0000
committersada <sada@FreeBSD.org>1999-04-21 13:30:01 +0000
commitb77bb336f91d563c94043b1d50ae78da2d23490c (patch)
tree755c5d8cf8024ace8907db0307726931055f6064 /sys/kern/sysv_msg.c
parent9b64807a87c76bb3c2bd53d4138cba2f24809603 (diff)
downloadFreeBSD-src-b77bb336f91d563c94043b1d50ae78da2d23490c.zip
FreeBSD-src-b77bb336f91d563c94043b1d50ae78da2d23490c.tar.gz
The function msgrcv() could copy larger data than it should do
under some circumstances. PR: kern/10765 Submitted by: Yasuhito FUTATSUKI <futatuki@fureai.or.jp>
Diffstat (limited to 'sys/kern/sysv_msg.c')
-rw-r--r--sys/kern/sysv_msg.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c
index 8b010b5..334bbf4 100644
--- a/sys/kern/sysv_msg.c
+++ b/sys/kern/sysv_msg.c
@@ -1,4 +1,4 @@
-/* $Id: sysv_msg.c,v 1.18 1998/03/30 09:50:35 phk Exp $ */
+/* $Id: sysv_msg.c,v 1.19 1999/01/30 12:21:48 phk Exp $ */
/*
* Implementation of SVID messages
@@ -996,10 +996,10 @@ msgrcv(p, uap)
for (len = 0; len < msgsz; len += msginfo.msgssz) {
size_t tlen;
- if (msgsz > msginfo.msgssz)
+ if (msgsz - len > msginfo.msgssz)
tlen = msginfo.msgssz;
else
- tlen = msgsz;
+ tlen = msgsz - len;
if (next <= -1)
panic("next too low #3");
if (next >= msginfo.msgseg)
OpenPOWER on IntegriCloud