Check the return value of sbuf_finish() in pfs_readlink() and return
ENAMETOOLONG if the buffer overflowed. Approved by: des MFC after: 2 weeks
This commit is contained in:
parent
cba3fc2b82
commit
3ff26fa74b
@ -891,7 +891,11 @@ pfs_readlink(struct vop_readlink_args *va)
|
|||||||
PFS_RETURN (error);
|
PFS_RETURN (error);
|
||||||
}
|
}
|
||||||
|
|
||||||
sbuf_finish(&sb);
|
if (sbuf_finish(&sb) != 0) {
|
||||||
|
sbuf_delete(&sb);
|
||||||
|
PFS_RETURN (ENAMETOOLONG);
|
||||||
|
}
|
||||||
|
|
||||||
error = uiomove_frombuf(sbuf_data(&sb), sbuf_len(&sb), uio);
|
error = uiomove_frombuf(sbuf_data(&sb), sbuf_len(&sb), uio);
|
||||||
sbuf_delete(&sb);
|
sbuf_delete(&sb);
|
||||||
PFS_RETURN (error);
|
PFS_RETURN (error);
|
||||||
|
Loading…
x
Reference in New Issue
Block a user