diff options
| author | tjr <tjr@FreeBSD.org> | 2003-01-12 09:40:23 +0000 |
|---|---|---|
| committer | tjr <tjr@FreeBSD.org> | 2003-01-12 09:40:23 +0000 |
| commit | 82072599177f6e7fde8fada3a4c0c8b8612020e7 (patch) | |
| tree | 222c6e29b7afe765e39c86468561bb0a19a16ee7 /sys/kern | |
| parent | ab252ec5bd40f5c9190293350dee97a9630e4d41 (diff) | |
| download | FreeBSD-src-82072599177f6e7fde8fada3a4c0c8b8612020e7.zip FreeBSD-src-82072599177f6e7fde8fada3a4c0c8b8612020e7.tar.gz | |
Allowing nent < 0 in aio_suspend() and lio_listio() is just asking for
trouble. Return EINVAL instead.
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/vfs_aio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c index 9d24702..23e49d5 100644 --- a/sys/kern/vfs_aio.c +++ b/sys/kern/vfs_aio.c @@ -1612,7 +1612,7 @@ aio_suspend(struct thread *td, struct aio_suspend_args *uap) long *ijoblist; struct aiocb **ujoblist; - if (uap->nent > AIO_LISTIO_MAX) + if (uap->nent < 0 || uap->nent > AIO_LISTIO_MAX) return EINVAL; timo = 0; @@ -1946,7 +1946,7 @@ lio_listio(struct thread *td, struct lio_listio_args *uap) return EINVAL; nent = uap->nent; - if (nent > AIO_LISTIO_MAX) + if (nent < 0 || nent > AIO_LISTIO_MAX) return EINVAL; if (p->p_aioinfo == NULL) |
