diff options
| author | ache <ache@FreeBSD.org> | 2001-08-23 17:56:48 +0000 |
|---|---|---|
| committer | ache <ache@FreeBSD.org> | 2001-08-23 17:56:48 +0000 |
| commit | a480a6737dc604419b27b637a6deb6b419674e7e (patch) | |
| tree | 99227ead8a51583f94f55e744c4938284d24bd71 /sys | |
| parent | 640689c04dbd2de4f7dbb7f9a56d614f31ab8fad (diff) | |
| download | FreeBSD-src-a480a6737dc604419b27b637a6deb6b419674e7e.zip FreeBSD-src-a480a6737dc604419b27b637a6deb6b419674e7e.tar.gz | |
vn_stat(): if va_size (u_quad_t) > OFF_MAX, return EOVERFLOW, don't copy it
blindly to st_size
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/vfs_vnops.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index de7a7ce..1cd6c99 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -55,6 +55,8 @@ #include <sys/ttycom.h> #include <sys/conf.h> +#include <machine/limits.h> + static int vn_closefile __P((struct file *fp, struct proc *p)); static int vn_ioctl __P((struct file *fp, u_long com, caddr_t data, struct proc *p)); @@ -499,6 +501,8 @@ vn_stat(vp, sb, p) sb->st_uid = vap->va_uid; sb->st_gid = vap->va_gid; sb->st_rdev = vap->va_rdev; + if (vap->va_size > OFF_MAX) + return (EOVERFLOW); sb->st_size = vap->va_size; sb->st_atimespec = vap->va_atime; sb->st_mtimespec = vap->va_mtime; |
