diff options
| author | trhodes <trhodes@FreeBSD.org> | 2006-10-14 10:30:14 +0000 |
|---|---|---|
| committer | trhodes <trhodes@FreeBSD.org> | 2006-10-14 10:30:14 +0000 |
| commit | e7d9ab08978136ae53298ee700121a023f30501c (patch) | |
| tree | 59f487923e701bd1c9d02cb0ddceab72c9809e9f /sys | |
| parent | c990b26f9c8c03b86fd30d9610c3cff8da4ab44a (diff) | |
| download | FreeBSD-src-e7d9ab08978136ae53298ee700121a023f30501c.zip FreeBSD-src-e7d9ab08978136ae53298ee700121a023f30501c.tar.gz | |
Close a race condition where num can be larger than tmp, giving the user
too large of a boundary.
Reported by: Ilja Van Sprundel
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/sys_process.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c index 20db01c..26dd0f7 100644 --- a/sys/kern/sys_process.c +++ b/sys/kern/sys_process.c @@ -980,7 +980,7 @@ kern_ptrace(struct thread *td, int req, pid_t pid, void *addr, int data) error = copyout(buf, addr, tmp * sizeof(lwpid_t)); free(buf, M_TEMP); if (!error) - td->td_retval[0] = num; + td->td_retval[0] = tmp; PROC_LOCK(p); break; |
