diff options
| author | SADA Kenji <sada@FreeBSD.org> | 1999-04-21 13:30:01 +0000 |
|---|---|---|
| committer | SADA Kenji <sada@FreeBSD.org> | 1999-04-21 13:30:01 +0000 |
| commit | 565592bd9cb804b6e6ce47abedcfba472a8b0d73 (patch) | |
| tree | 0f7db3452c021fb4c134ca2a57f0cb89192cf1e8 /sys/kern | |
| parent | 866a5402874fc6b6adec62297aa46bbbcf7fc914 (diff) | |
| download | src-565592bd9cb804b6e6ce47abedcfba472a8b0d73.tar.gz src-565592bd9cb804b6e6ce47abedcfba472a8b0d73.zip | |
The function msgrcv() could copy larger data than it should do
under some circumstances.
PR: kern/10765
Submitted by: Yasuhito FUTATSUKI <futatuki@fureai.or.jp>
Notes
Notes:
svn path=/head/; revision=45921
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/sysv_msg.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c index 8b010b5566f6..334bbf4844a1 100644 --- a/sys/kern/sysv_msg.c +++ b/sys/kern/sysv_msg.c @@ -1,4 +1,4 @@ -/* $Id: sysv_msg.c,v 1.18 1998/03/30 09:50:35 phk Exp $ */ +/* $Id: sysv_msg.c,v 1.19 1999/01/30 12:21:48 phk Exp $ */ /* * Implementation of SVID messages @@ -996,10 +996,10 @@ msgrcv(p, uap) for (len = 0; len < msgsz; len += msginfo.msgssz) { size_t tlen; - if (msgsz > msginfo.msgssz) + if (msgsz - len > msginfo.msgssz) tlen = msginfo.msgssz; else - tlen = msgsz; + tlen = msgsz - len; if (next <= -1) panic("next too low #3"); if (next >= msginfo.msgseg) |