diff options
author | Tim J. Robbins <tjr@FreeBSD.org> | 2003-01-12 09:40:23 +0000 |
---|---|---|
committer | Tim J. Robbins <tjr@FreeBSD.org> | 2003-01-12 09:40:23 +0000 |
commit | ae3b195fcf71d8d50329c8ed6a1da19b5d895bf8 (patch) | |
tree | 222c6e29b7afe765e39c86468561bb0a19a16ee7 /sys | |
parent | 44a2c818dee401b5bbe268543be56e1c61b51494 (diff) | |
download | src-ae3b195fcf71d8d50329c8ed6a1da19b5d895bf8.tar.gz src-ae3b195fcf71d8d50329c8ed6a1da19b5d895bf8.zip |
Allowing nent < 0 in aio_suspend() and lio_listio() is just asking for
trouble. Return EINVAL instead.
Notes
Notes:
svn path=/head/; revision=109137
Diffstat (limited to 'sys')
-rw-r--r-- | sys/kern/vfs_aio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c index 9d2470263de8..23e49d570542 100644 --- a/sys/kern/vfs_aio.c +++ b/sys/kern/vfs_aio.c @@ -1612,7 +1612,7 @@ aio_suspend(struct thread *td, struct aio_suspend_args *uap) long *ijoblist; struct aiocb **ujoblist; - if (uap->nent > AIO_LISTIO_MAX) + if (uap->nent < 0 || uap->nent > AIO_LISTIO_MAX) return EINVAL; timo = 0; @@ -1946,7 +1946,7 @@ lio_listio(struct thread *td, struct lio_listio_args *uap) return EINVAL; nent = uap->nent; - if (nent > AIO_LISTIO_MAX) + if (nent < 0 || nent > AIO_LISTIO_MAX) return EINVAL; if (p->p_aioinfo == NULL) |