From 6ee3b2604446adfaaa390288cb2f3c64669c973e Mon Sep 17 00:00:00 2001
From: bde <bde@FreeBSD.org>
Date: Sun, 14 Jun 1998 12:34:42 +0000
Subject: Avoid a 64-bit division in kernfs_readdir().  Fixed related overflows
 and arg checking.

---
 sys/miscfs/kernfs/kernfs_vnops.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sys/miscfs/kernfs/kernfs_vnops.c b/sys/miscfs/kernfs/kernfs_vnops.c
index 1011c49..a6bbfec 100644
--- a/sys/miscfs/kernfs/kernfs_vnops.c
+++ b/sys/miscfs/kernfs/kernfs_vnops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
- * $Id: kernfs_vnops.c,v 1.31 1998/06/10 06:34:56 peter Exp $
+ * $Id: kernfs_vnops.c,v 1.32 1998/06/10 21:21:30 dfr Exp $
  */
 
 /*
@@ -524,7 +524,7 @@ kernfs_readdir(ap)
 		int a_ncookies;
 	} */ *ap;
 {
-	int error, i;
+	int error, i, off;
 	struct uio *uio = ap->a_uio;
 	struct kern_target *kt;
 	struct dirent d;
@@ -539,7 +539,12 @@ kernfs_readdir(ap)
 	if (ap->a_ncookies != NULL)
 		panic("kernfs_readdir: not hungry");
 
-	i = uio->uio_offset / UIO_MX;
+	off = (int)uio->uio_offset;
+	if (off != uio->uio_offset || off < 0 || (u_int)off % UIO_MX != 0 ||
+	    uio->uio_resid < UIO_MX)
+		return (EINVAL);
+
+	i = (u_int)off / UIO_MX;
 	error = 0;
 	for (kt = &kern_targets[i];
 		uio->uio_resid >= UIO_MX && i < nkern_targets; kt++, i++) {
-- 
cgit v1.1