diff options
| author |   deraadt <deraadt@openbsd.org> | 1997-01-31 10:30:48 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 1997-01-31 10:30:48 +0000 |
| commit | 4d1376da868886d86df5cfedc744599007f52856 (patch) | |
| tree | f2fc6503466e9b030603d06f46051531d1330093 | |
| parent | stop crash from walking off end of malloc'd page. i hunted this bug before (diff) | |
| download | wireguard-openbsd-4d1376da868886d86df5cfedc744599007f52856.tar.xz wireguard-openbsd-4d1376da868886d86df5cfedc744599007f52856.zip | |
do not walk off the end of a directory info buffer; netbsd pr#3170, mhitch@gemini.oscs.montana.edu
| -rw-r--r-- | sys/nfs/nfs_serv.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/nfs/nfs_serv.c b/sys/nfs/nfs_serv.c index d18d4fc6937..81ed30ef401 100644 --- a/sys/nfs/nfs_serv.c +++ b/sys/nfs/nfs_serv.c @@ -1,4 +1,4 @@ -/* $OpenBSD: nfs_serv.c,v 1.9 1997/01/28 18:50:21 niklas Exp $ */ +/* $OpenBSD: nfs_serv.c,v 1.10 1997/01/31 10:30:48 deraadt Exp $ */ /* $NetBSD: nfs_serv.c,v 1.25 1996/03/02 15:55:52 jtk Exp $ */ /* @@ -2803,8 +2803,8 @@ again: dp = (struct dirent *)cpos; cookiep = cookies; - while ((dp->d_fileno == 0 || dp->d_type == DT_WHT) - && cpos < cend && ncookies > 0) { + while (cpos < cend && ncookies > 0 + && (dp->d_fileno == 0 || dp->d_type == DT_WHT)) { cpos += dp->d_reclen; dp = (struct dirent *)cpos; cookiep++; |