diff options
author | des <des@FreeBSD.org> | 2005-03-14 16:21:32 +0000 |
---|---|---|
committer | des <des@FreeBSD.org> | 2005-03-14 16:21:32 +0000 |
commit | aa287f3e1243d4a4883f7adc0ace6827583e7e64 (patch) | |
tree | f6b611aee003fb449dcb05743c31032430aaf56f /sys/netinet/tcp_usrreq.c | |
parent | 892fcdb014bcdef9a9b18009d26f6f9f532f8d07 (diff) | |
download | FreeBSD-src-aa287f3e1243d4a4883f7adc0ace6827583e7e64.zip FreeBSD-src-aa287f3e1243d4a4883f7adc0ace6827583e7e64.tar.gz |
Fix two long-standing bugs in pfs_readdir():
Since we used an sbuf of size resid to accumulate dirents, we would end
up returning one byte short when we had enough dirents to fill or exceed
the size of the sbuf (the last byte being lost to bogus NUL termination)
causing the next call to return EINVAL due to an unaligned offset. This
went undetected for a long time because I did most of my testing in
single-user mode, where there are rarely enough processes to fill the
4096-byte buffer ls(1) uses. The most common symptom of this bug is that
tab completion of /proc or /compat/linux/proc does not work properly when
many processes are running.
Also, a check near the top would return EINVAL if resid was smaller than
PFS_DELEN, even if it was 0, which is frequently the case and perfectly
allowable. Change the test so that it returns 0 if resid is 0.
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet/tcp_usrreq.c')
0 files changed, 0 insertions, 0 deletions