From 565592bd9cb804b6e6ce47abedcfba472a8b0d73 Mon Sep 17 00:00:00 2001
From: SADA Kenji <sada@FreeBSD.org>
Date: Wed, 21 Apr 1999 13:30:01 +0000
Subject: [PATCH] The function msgrcv() could copy larger data than it should
 do under some circumstances. PR:		kern/10765 Submitted by:
 Yasuhito FUTATSUKI <futatuki@fureai.or.jp>

---
 sys/kern/sysv_msg.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c
index 8b010b5566f6..334bbf4844a1 100644
--- a/sys/kern/sysv_msg.c
+++ b/sys/kern/sysv_msg.c
@@ -1,4 +1,4 @@
-/*	$Id: sysv_msg.c,v 1.18 1998/03/30 09:50:35 phk Exp $ */
+/*	$Id: sysv_msg.c,v 1.19 1999/01/30 12:21:48 phk Exp $ */
 
 /*
  * Implementation of SVID messages
@@ -996,10 +996,10 @@ msgrcv(p, uap)
 	for (len = 0; len < msgsz; len += msginfo.msgssz) {
 		size_t tlen;
 
-		if (msgsz > msginfo.msgssz)
+		if (msgsz - len > msginfo.msgssz)
 			tlen = msginfo.msgssz;
 		else
-			tlen = msgsz;
+			tlen = msgsz - len;
 		if (next <= -1)
 			panic("next too low #3");
 		if (next >= msginfo.msgseg)