devstat_selectdevs: resize dev_select only after copying data out of it
The resizing could be a downsizing so some data would be lost and we could attempt to read past the end of the new memory allocation. MFC after: 2 weeks Sponsored by: Panzura
This commit is contained in:
parent
3995097fde
commit
84a03ac69a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=355325
@ -584,10 +584,10 @@ devstat_selectdevs(struct device_selection **dev_select, int *num_selected,
|
|||||||
* In this case, we have selected devices before, but the device
|
* In this case, we have selected devices before, but the device
|
||||||
* list has changed since we last selected devices, so we need to
|
* list has changed since we last selected devices, so we need to
|
||||||
* either enlarge or reduce the size of the device selection list.
|
* either enlarge or reduce the size of the device selection list.
|
||||||
|
* But delay the resizing until after copying the data to old_dev_select
|
||||||
|
* as to not lose any data in the case of reducing the size.
|
||||||
*/
|
*/
|
||||||
} else if (*num_selections != numdevs) {
|
} else if (*num_selections != numdevs) {
|
||||||
*dev_select = (struct device_selection *)reallocf(*dev_select,
|
|
||||||
numdevs * sizeof(struct device_selection));
|
|
||||||
*select_generation = current_generation;
|
*select_generation = current_generation;
|
||||||
init_selections = 1;
|
init_selections = 1;
|
||||||
/*
|
/*
|
||||||
@ -645,6 +645,11 @@ devstat_selectdevs(struct device_selection **dev_select, int *num_selected,
|
|||||||
sizeof(struct device_selection) * *num_selections);
|
sizeof(struct device_selection) * *num_selections);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!changed && *num_selections != numdevs) {
|
||||||
|
*dev_select = (struct device_selection *)reallocf(*dev_select,
|
||||||
|
numdevs * sizeof(struct device_selection));
|
||||||
|
}
|
||||||
|
|
||||||
if (init_selections != 0) {
|
if (init_selections != 0) {
|
||||||
bzero(*dev_select, sizeof(struct device_selection) * numdevs);
|
bzero(*dev_select, sizeof(struct device_selection) * numdevs);
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user