2 files changed, 15 insertions, 6 deletions

diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
index 9eaa7d2..9ac5fc2 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
@@ -1604,16 +1604,21 @@ zfsctl_snapshot_vptocnp(struct vop_vptocnp_args *ap)
 	}
 	if (sep == NULL) {
 		mutex_exit(&sdp->sd_lock);
-		error = ENOENT;
+		error = SET_ERROR(ENOENT);
 	} else {
 		size_t len;
 
 		len = strlen(sep->se_name);
-		*ap->a_buflen -= len;
-		bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
-		mutex_exit(&sdp->sd_lock);
-		vref(dvp);
-		*ap->a_vpp = dvp;
+		if (*ap->a_buflen < len) {
+			mutex_exit(&sdp->sd_lock);
+			error = SET_ERROR(ENOMEM);
+		} else {
+			*ap->a_buflen -= len;
+			bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
+			mutex_exit(&sdp->sd_lock);
+			vref(dvp);
+			*ap->a_vpp = dvp;
+		}
 	}
 	VN_RELE(dvp);
 
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
index fa22523..bdab09e 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
@@ -5984,6 +5984,10 @@ zfs_vptocnp(struct vop_vptocnp_args *ap)
 		error = zfs_znode_parent_and_name(zp, &dzp, name);
 		if (error == 0) {
 			len = strlen(name);
+			if (*ap->a_buflen < len)
+				error = SET_ERROR(ENOMEM);
+		}
+		if (error == 0) {
 			*ap->a_buflen -= len;
 			bcopy(name, ap->a_buf + *ap->a_buflen, len);
 			*ap->a_vpp = ZTOV(dzp);