[src/trunk]: src/sys/compat/darwin - Avoid overflow by checking the count arg...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d0ef2bfc93b7
branches:  trunk
changeset: 584305:d0ef2bfc93b7
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Sep 12 20:54:38 2005 +0000

description:
- Avoid overflow by checking the count argument (Christer Oeberg).
- While I am here, don't leak fds either.

diffstat:

 sys/compat/darwin/darwin_mman.c |  13 +++++--------
 1 files changed, 5 insertions(+), 8 deletions(-)

diffs (36 lines):

diff -r b091a9f6dd33 -r d0ef2bfc93b7 sys/compat/darwin/darwin_mman.c
--- a/sys/compat/darwin/darwin_mman.c   Mon Sep 12 20:26:44 2005 +0000
+++ b/sys/compat/darwin/darwin_mman.c   Mon Sep 12 20:54:38 2005 +0000
@@ -1,6 +1,6 @@
 #undef DEBUG_DARWIN
 #undef DEBUG_MACH
-/*     $NetBSD: darwin_mman.c,v 1.15 2005/02/26 23:10:18 perry Exp $ */
+/*     $NetBSD: darwin_mman.c,v 1.16 2005/09/12 20:54:38 christos Exp $ */
 
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: darwin_mman.c,v 1.15 2005/02/26 23:10:18 perry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: darwin_mman.c,v 1.16 2005/09/12 20:54:38 christos Exp $");
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -138,12 +138,9 @@
        vp = (struct vnode *)fp->f_data;
        vref(vp);
 
-       /* XXX maximum count ? */
-       if (SCARG(uap, count) < 0)
-               return EINVAL;
-       maplen = sizeof(*mapp) * SCARG(uap, count);
-       if (maplen > PAGE_SIZE) {
-               error = ENOMEM;
+       if (SCARG(uap, count) < 0 ||
+           SCARG(uap, count) > PAGE_SIZE / sizeof(*mapp)) {
+               errno = EINVAL;
                goto bad3;
        }
        mapp = malloc(sizeof(*mapp) * SCARG(uap, count), M_TEMP, M_WAITOK);