d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The function msgrcv() could copy larger data than it should do

Browse Source 
under some circumstances.
PR:		kern/10765
Submitted by:	Yasuhito FUTATSUKI <futatuki@fureai.or.jp>
This commit is contained in:
SADA Kenji 1999-04-21 13:30:01 +00:00
parent 866a540287
commit 565592bd9c
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/kern/sysv_msg.c
View File

@ -1,4 +1,4 @@
/* $Id: sysv_msg.c,v 1.18 1998/03/30 09:50:35 phk Exp $ */ /* $Id: sysv_msg.c,v 1.19 1999/01/30 12:21:48 phk Exp $ */
/* /*
* Implementation of SVID messages * Implementation of SVID messages
@ -996,10 +996,10 @@ msgrcv(p, uap)
for (len = 0; len < msgsz; len += msginfo.msgssz) { for (len = 0; len < msgsz; len += msginfo.msgssz) {
size_t tlen; size_t tlen;
if (msgsz > msginfo.msgssz) if (msgsz - len > msginfo.msgssz)
tlen = msginfo.msgssz; tlen = msginfo.msgssz;
else else
tlen = msgsz; tlen = msgsz - len;
if (next <= -1) if (next <= -1)
panic("next too low #3"); panic("next too low #3");
if (next >= msginfo.msgseg) if (next >= msginfo.msgseg)