diff options
author | wollman <wollman@FreeBSD.org> | 1997-02-13 18:05:46 +0000 |
---|---|---|
committer | wollman <wollman@FreeBSD.org> | 1997-02-13 18:05:46 +0000 |
commit | 8a5f6f307324acd368703c5b889d82f6d470bde0 (patch) | |
tree | 5f77e77a409ce875b31361afa875804fe5976ada /sys/kern | |
parent | deedd1a7686cac10c7f7e55c95b947fb5ddc04a2 (diff) | |
download | FreeBSD-src-8a5f6f307324acd368703c5b889d82f6d470bde0.zip FreeBSD-src-8a5f6f307324acd368703c5b889d82f6d470bde0.tar.gz |
For large values of sb_max or MCLBYTES, it was possible for the expression
sb_max * MCLBYTES / (MSIZE + MCLBYTES)
used in sbreserve() to overflow, causing all socket creation attempts
to fail. Force the calculation to use u_quad_t's, which makes overflow
less likely.
Diffstat (limited to 'sys/kern')
-rw-r--r-- | sys/kern/uipc_sockbuf.c | 3 | ||||
-rw-r--r-- | sys/kern/uipc_socket2.c | 3 |
2 files changed, 2 insertions, 4 deletions
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c index d952de8..463b4bb 100644 --- a/sys/kern/uipc_sockbuf.c +++ b/sys/kern/uipc_sockbuf.c @@ -405,8 +405,7 @@ sbreserve(sb, cc) struct sockbuf *sb; u_long cc; { - - if (cc > sb_max * MCLBYTES / (MSIZE + MCLBYTES)) + if ((u_quad_t)cc > (u_quad_t)sb_max * MCLBYTES / (MSIZE + MCLBYTES)) return (0); sb->sb_hiwat = cc; sb->sb_mbmax = min(cc * sb_efficiency, sb_max); diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c index d952de8..463b4bb 100644 --- a/sys/kern/uipc_socket2.c +++ b/sys/kern/uipc_socket2.c @@ -405,8 +405,7 @@ sbreserve(sb, cc) struct sockbuf *sb; u_long cc; { - - if (cc > sb_max * MCLBYTES / (MSIZE + MCLBYTES)) + if ((u_quad_t)cc > (u_quad_t)sb_max * MCLBYTES / (MSIZE + MCLBYTES)) return (0); sb->sb_hiwat = cc; sb->sb_mbmax = min(cc * sb_efficiency, sb_max); |