diff options
| author | Chris D. Faulhaber <jedgar@FreeBSD.org> | 2003-03-20 13:05:28 +0000 |
|---|---|---|
| committer | Chris D. Faulhaber <jedgar@FreeBSD.org> | 2003-03-20 13:05:28 +0000 |
| commit | a9c64d56cb5c8a5fe1f5e0e57a525ff61b8755de (patch) | |
| tree | c9a952e3f97e7bb888243fb681242605b5f838dc | |
| parent | 4817ee36a33662419d87f5a8ed5f7ac6d38737d0 (diff) | |
Notes
| -rw-r--r-- | UPDATING | 3 | ||||
| -rw-r--r-- | include/rpc/xdr.h | 2 | ||||
| -rw-r--r-- | lib/libc/xdr/xdr_mem.c | 22 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 |
4 files changed, 19 insertions, 10 deletions
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch. For those updates that don't have an advisory, or to be safe, you can do a full build and install as described in the COMMON ITEMS section. +20030320: p8 FreeBSD-SA-03:05.xdr + integer overflow errors in the Sun XDR library. + 20030303: p7 FreeBSD-SA-03:04.sendmail sendmail header parsing buffer overflow, ident parsing bug. diff --git a/include/rpc/xdr.h b/include/rpc/xdr.h index 2ce9205422e6..cceb8336fbcd 100644 --- a/include/rpc/xdr.h +++ b/include/rpc/xdr.h @@ -118,7 +118,7 @@ typedef struct __rpc_xdr { caddr_t x_public; /* users' data */ caddr_t x_private; /* pointer to private data */ caddr_t x_base; /* private used for position info */ - int x_handy; /* extra private word */ + u_int x_handy; /* extra private word */ } XDR; /* diff --git a/lib/libc/xdr/xdr_mem.c b/lib/libc/xdr/xdr_mem.c index 3193e64939dd..fc7f51784145 100644 --- a/lib/libc/xdr/xdr_mem.c +++ b/lib/libc/xdr/xdr_mem.c @@ -115,8 +115,9 @@ xdrmem_getlong_aligned(xdrs, lp) long *lp; { - if ((xdrs->x_handy -= sizeof(int32_t)) < 0) + if (xdrs->x_handy < sizeof(int32_t)) return (FALSE); + xdrs->x_handy -= sizeof(int32_t); *lp = ntohl(*(int32_t *)(xdrs->x_private)); xdrs->x_private += sizeof(int32_t); return (TRUE); @@ -128,8 +129,9 @@ xdrmem_putlong_aligned(xdrs, lp) long *lp; { - if ((xdrs->x_handy -= sizeof(int32_t)) < 0) + if (xdrs->x_handy < sizeof(int32_t)) return (FALSE); + xdrs->x_handy -= sizeof(int32_t); *(int32_t *)xdrs->x_private = htonl(*lp); xdrs->x_private += sizeof(int32_t); return (TRUE); @@ -142,8 +144,9 @@ xdrmem_getlong_unaligned(xdrs, lp) { int32_t l; - if ((xdrs->x_handy -= sizeof(int32_t)) < 0) + if (xdrs->x_handy < sizeof(int32_t)) return (FALSE); + xdrs->x_handy -= sizeof(int32_t); memcpy(&l, xdrs->x_private, sizeof(int32_t)); *lp = ntohl(l); xdrs->x_private += sizeof(int32_t); @@ -157,8 +160,9 @@ xdrmem_putlong_unaligned(xdrs, lp) { int32_t l; - if ((xdrs->x_handy -= sizeof(int32_t)) < 0) + if (xdrs->x_handy < sizeof(int32_t)) return (FALSE); + xdrs->x_handy -= sizeof(int32_t); l = htonl(*lp); memcpy(xdrs->x_private, &l, sizeof(int32_t)); xdrs->x_private += sizeof(int32_t); @@ -172,8 +176,9 @@ xdrmem_getbytes(xdrs, addr, len) register u_int len; { - if ((xdrs->x_handy -= len) < 0) + if (xdrs->x_handy < len) return (FALSE); + xdrs->x_handy -= len; memcpy(addr, xdrs->x_private, len); xdrs->x_private += len; return (TRUE); @@ -186,8 +191,9 @@ xdrmem_putbytes(xdrs, addr, len) register u_int len; { - if ((xdrs->x_handy -= len) < 0) + if (xdrs->x_handy < len) return (FALSE); + xdrs->x_handy -= len; memcpy(xdrs->x_private, addr, len); xdrs->x_private += len; return (TRUE); @@ -210,10 +216,10 @@ xdrmem_setpos(xdrs, pos) register caddr_t newaddr = xdrs->x_base + pos; register caddr_t lastaddr = xdrs->x_private + xdrs->x_handy; - if ((long)newaddr > (long)lastaddr) + if (newaddr > lastaddr) return (FALSE); xdrs->x_private = newaddr; - xdrs->x_handy = (long)lastaddr - (long)newaddr; + xdrs->x_handy = (u_int)(lastaddr - newaddr); /* XXX sizeof(u_int) <? sizeof(ptrdiff_t) */ return (TRUE); } diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 719460213cec..cd95bfbee9c5 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -36,7 +36,7 @@ TYPE="FreeBSD" REVISION="4.7" -BRANCH="RELEASE-p7" +BRANCH="RELEASE-p8" RELEASE="${REVISION}-${BRANCH}" VERSION="${TYPE} ${RELEASE}" |