[src/netbsd-1-4]: src/sys/compat/ibcs2 Pull up revision 1.16 (requested by si...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2f68723d9050
branches:  netbsd-1-4
changeset: 470888:2f68723d9050
user:      he <he%NetBSD.org@localhost>
date:      Sat Sep 09 15:54:17 2000 +0000

description:
Pull up revision 1.16 (requested by simonb):
  More carefully check length of user-supplied data, in particular
  make sure we don't overrun the available stack gap in stack gap
  allocations.

diffstat:

 sys/compat/ibcs2/ibcs2_stat.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (34 lines):

diff -r 05ada5f28ce4 -r 2f68723d9050 sys/compat/ibcs2/ibcs2_stat.c
--- a/sys/compat/ibcs2/ibcs2_stat.c     Sat Sep 09 15:53:59 2000 +0000
+++ b/sys/compat/ibcs2/ibcs2_stat.c     Sat Sep 09 15:54:17 2000 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_stat.c,v 1.11 1999/02/09 20:48:20 christos Exp $ */
+/*     $NetBSD: ibcs2_stat.c,v 1.11.2.1 2000/09/09 15:54:17 he Exp $   */
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -252,10 +252,10 @@
        struct sys___stat13_args cup;
        int error;
        caddr_t sg = stackgap_init(p->p_emul);
-
+       SCARG(&cup, ub) = stackgap_alloc(&sg, sizeof(st));
        IBCS2_CHECK_ALT_EXIST(p, &sg, SCARG(uap, path));
        SCARG(&cup, path) = SCARG(uap, path);
-       SCARG(&cup, ub) = stackgap_alloc(&sg, sizeof(st));
+
        if ((error = sys___stat13(p, &cup, retval)) != 0)
                return error;
        if ((error = copyin(SCARG(&cup, ub), &st, sizeof(st))) != 0)
@@ -281,9 +281,10 @@
        int error;
        caddr_t sg = stackgap_init(p->p_emul);
 
+       SCARG(&cup, ub) = stackgap_alloc(&sg, sizeof(st));
        IBCS2_CHECK_ALT_EXIST(p, &sg, SCARG(uap, path));
        SCARG(&cup, path) = SCARG(uap, path);
-       SCARG(&cup, ub) = stackgap_alloc(&sg, sizeof(st));
+
        if ((error = sys___lstat13(p, &cup, retval)) != 0)
                return error;
        if ((error = copyin(SCARG(&cup, ub), &st, sizeof(st))) != 0)