diff options
| author | pjd <pjd@FreeBSD.org> | 2012-06-13 22:12:10 +0000 |
|---|---|---|
| committer | pjd <pjd@FreeBSD.org> | 2012-06-13 22:12:10 +0000 |
| commit | 0ca632f7e9e457afd6f19baf33eb7cb22413134d (patch) | |
| tree | b96b78e408d13c812513bee0b944fc3cdc587057 /sys/kern/uipc_usrreq.c | |
| parent | 786835d5893758148a31887979a8c26809d3a958 (diff) | |
| download | FreeBSD-src-0ca632f7e9e457afd6f19baf33eb7cb22413134d.zip FreeBSD-src-0ca632f7e9e457afd6f19baf33eb7cb22413134d.tar.gz | |
When checking if file descriptor number is valid, explicitely check for 'fd'
being less than 0 instead of using cast-to-unsigned hack.
Today's commit was brought to you by the letters 'B', 'D' and 'E' :)
Diffstat (limited to 'sys/kern/uipc_usrreq.c')
| -rw-r--r-- | sys/kern/uipc_usrreq.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 72cc483..504d581 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -1872,7 +1872,7 @@ unp_internalize(struct mbuf **controlp, struct thread *td) FILEDESC_SLOCK(fdescp); for (i = 0; i < oldfds; i++) { fd = *fdp++; - if ((unsigned)fd >= fdescp->fd_nfiles || + if (fd < 0 || fd >= fdescp->fd_nfiles || fdescp->fd_ofiles[fd] == NULL) { FILEDESC_SUNLOCK(fdescp); error = EBADF; |
