diff options
author | Garrett Wollman <wollman@FreeBSD.org> | 1997-02-13 18:05:46 +0000 |
---|---|---|
committer | Garrett Wollman <wollman@FreeBSD.org> | 1997-02-13 18:05:46 +0000 |
commit | 5bee01c83f3afcfb75986acbfb81064b7c72d0c6 (patch) | |
tree | 5f77e77a409ce875b31361afa875804fe5976ada /sys/kern | |
parent | 8c21e889fd5aafafe25ea0d872d434182ac4e18d (diff) | |
download | src-5bee01c83f3afcfb75986acbfb81064b7c72d0c6.tar.gz src-5bee01c83f3afcfb75986acbfb81064b7c72d0c6.zip |
For large values of sb_max or MCLBYTES, it was possible for the expression
sb_max * MCLBYTES / (MSIZE + MCLBYTES)
used in sbreserve() to overflow, causing all socket creation attempts
to fail. Force the calculation to use u_quad_t's, which makes overflow
less likely.
Notes
Notes:
svn path=/head/; revision=22658
Diffstat (limited to 'sys/kern')
-rw-r--r-- | sys/kern/uipc_sockbuf.c | 3 | ||||
-rw-r--r-- | sys/kern/uipc_socket2.c | 3 |
2 files changed, 2 insertions, 4 deletions
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c index d952de839d97..463b4bbddea2 100644 --- a/sys/kern/uipc_sockbuf.c +++ b/sys/kern/uipc_sockbuf.c @@ -405,8 +405,7 @@ sbreserve(sb, cc) struct sockbuf *sb; u_long cc; { - - if (cc > sb_max * MCLBYTES / (MSIZE + MCLBYTES)) + if ((u_quad_t)cc > (u_quad_t)sb_max * MCLBYTES / (MSIZE + MCLBYTES)) return (0); sb->sb_hiwat = cc; sb->sb_mbmax = min(cc * sb_efficiency, sb_max); diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c index d952de839d97..463b4bbddea2 100644 --- a/sys/kern/uipc_socket2.c +++ b/sys/kern/uipc_socket2.c @@ -405,8 +405,7 @@ sbreserve(sb, cc) struct sockbuf *sb; u_long cc; { - - if (cc > sb_max * MCLBYTES / (MSIZE + MCLBYTES)) + if ((u_quad_t)cc > (u_quad_t)sb_max * MCLBYTES / (MSIZE + MCLBYTES)) return (0); sb->sb_hiwat = cc; sb->sb_mbmax = min(cc * sb_efficiency, sb_max); |