d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Though malloc allocates only cn.cn_namelen bytes for cn.cn_pnbuf in

Browse Source 
union_vn_create(), following bcopy copies cn.cn_namlen + 1 bytes to
cn.cn_pnbuf

PR:		3255
Reviewed by:	phk
Submitted by:	kato
This commit is contained in:
Poul-Henning Kamp 1997-04-13 06:25:03 +00:00
parent ae9d2b47e0
commit 9fa6ee7671
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/fs/unionfs/union_subr.c
View File

@ -35,7 +35,7 @@
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* @(#)union_subr.c 8.20 (Berkeley) 5/20/95 * @(#)union_subr.c 8.20 (Berkeley) 5/20/95
* $Id: union_subr.c,v 1.14 1997/02/22 09:40:40 peter Exp $ * $Id: union_subr.c,v 1.15 1997/03/23 03:36:59 bde Exp $
*/ */
#include <sys/param.h> #include <sys/param.h>
@ -895,7 +895,7 @@ union_vn_create(vpp, un, p)
* copied in the first place). * copied in the first place).
*/ */
cn.cn_namelen = strlen(un->un_path); cn.cn_namelen = strlen(un->un_path);
cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen, M_NAMEI, M_WAITOK); cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen+1, M_NAMEI, M_WAITOK);
bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1); bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1);
cn.cn_nameiop = CREATE; cn.cn_nameiop = CREATE;
cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN); cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);

4
sys/miscfs/union/union_subr.c
View File

@ -35,7 +35,7 @@
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* @(#)union_subr.c 8.20 (Berkeley) 5/20/95 * @(#)union_subr.c 8.20 (Berkeley) 5/20/95
* $Id: union_subr.c,v 1.14 1997/02/22 09:40:40 peter Exp $ * $Id: union_subr.c,v 1.15 1997/03/23 03:36:59 bde Exp $
*/ */
#include <sys/param.h> #include <sys/param.h>
@ -895,7 +895,7 @@ union_vn_create(vpp, un, p)
* copied in the first place). * copied in the first place).
*/ */
cn.cn_namelen = strlen(un->un_path); cn.cn_namelen = strlen(un->un_path);
cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen, M_NAMEI, M_WAITOK); cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen+1, M_NAMEI, M_WAITOK);
bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1); bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1);
cn.cn_nameiop = CREATE; cn.cn_nameiop = CREATE;
cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN); cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);