From e9d095afdc26cc31afa7ed3b3f138d3719636091 Mon Sep 17 00:00:00 2001
From: "Andrey A. Chernov" <ache@FreeBSD.org>
Date: Thu, 23 Aug 2001 08:20:21 +0000
Subject: [PATCH] adv. lock: detect off_t overflow _before_ it occurse and
 return EOVERFLOW instead of EINVAL

---
 sys/nfs/nfs_lock.c       | 10 +++++-----
 sys/nfsclient/nfs_lock.c | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/sys/nfs/nfs_lock.c b/sys/nfs/nfs_lock.c
index 9e28eeb8a600..94b5df1c999a 100644
--- a/sys/nfs/nfs_lock.c
+++ b/sys/nfs/nfs_lock.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#include <machine/limits.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/fcntl.h>
@@ -98,13 +99,12 @@ nfs_dolock(ap)
 
 	/*
 	 * the NLM protocol doesn't allow the server to return an error
-	 * on ranges, so we do it.  Note that we should be returning 
-	 * EOVERFLOW in some cases, but we don't have it.
+	 * on ranges, so we do it.
 	 */
-	if (fl->l_start < 0 || fl->l_len < 0 ||
-	    ((fl->l_len != 0 &&
-	     (fl->l_start + fl->l_len - 1) < 0)))
+	if (fl->l_start < 0 || fl->l_len < 0)
 		return (EINVAL);
+	if (fl->l_len != 0 && (fl->l_len - 1 > OFF_MAX - fl->l_start))
+		return (EOVERFLOW);
 
 	/*
 	 * Fill in the information structure.
diff --git a/sys/nfsclient/nfs_lock.c b/sys/nfsclient/nfs_lock.c
index 9e28eeb8a600..94b5df1c999a 100644
--- a/sys/nfsclient/nfs_lock.c
+++ b/sys/nfsclient/nfs_lock.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#include <machine/limits.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/fcntl.h>
@@ -98,13 +99,12 @@ nfs_dolock(ap)
 
 	/*
 	 * the NLM protocol doesn't allow the server to return an error
-	 * on ranges, so we do it.  Note that we should be returning 
-	 * EOVERFLOW in some cases, but we don't have it.
+	 * on ranges, so we do it.
 	 */
-	if (fl->l_start < 0 || fl->l_len < 0 ||
-	    ((fl->l_len != 0 &&
-	     (fl->l_start + fl->l_len - 1) < 0)))
+	if (fl->l_start < 0 || fl->l_len < 0)
 		return (EINVAL);
+	if (fl->l_len != 0 && (fl->l_len - 1 > OFF_MAX - fl->l_start))
+		return (EOVERFLOW);
 
 	/*
 	 * Fill in the information structure.