aboutsummaryrefslogtreecommitdiff
path: root/website/static/security/patches/SA-03:05/xdr-5.patch
blob: 712f29e9a85951c1537359520099be64638f2d08 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
Index: include/rpc/xdr.h
===================================================================
RCS file: /home/ncvs/src/include/rpc/xdr.h,v
retrieving revision 1.21
diff -u -r1.21 xdr.h
--- include/rpc/xdr.h	28 Apr 2002 15:18:45 -0000	1.21
+++ include/rpc/xdr.h	20 Mar 2003 01:08:13 -0000
@@ -121,7 +121,7 @@
 	char *	 	x_public;	/* users' data */
 	void *		x_private;	/* pointer to private data */
 	char * 		x_base;		/* private used for position info */
-	int		x_handy;	/* extra private word */
+	u_int		x_handy;	/* extra private word */
 } XDR;
 
 /*
Index: lib/libc/xdr/xdr_mem.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/xdr/xdr_mem.c,v
retrieving revision 1.11
diff -u -r1.11 xdr_mem.c
--- lib/libc/xdr/xdr_mem.c	22 Mar 2002 21:53:26 -0000	1.11
+++ lib/libc/xdr/xdr_mem.c	20 Mar 2003 01:08:13 -0000
@@ -126,8 +126,9 @@
 	long *lp;
 {
 
-	if ((xdrs->x_handy -= sizeof(int32_t)) < 0)
+	if (xdrs->x_handy < sizeof(int32_t))
 		return (FALSE);
+	xdrs->x_handy -= sizeof(int32_t);
 	*lp = ntohl(*(u_int32_t *)xdrs->x_private);
 	xdrs->x_private = (char *)xdrs->x_private + sizeof(int32_t);
 	return (TRUE);
@@ -139,8 +140,9 @@
 	const long *lp;
 {
 
-	if ((xdrs->x_handy -= sizeof(int32_t)) < 0)
+	if (xdrs->x_handy < sizeof(int32_t))
 		return (FALSE);
+	xdrs->x_handy -= sizeof(int32_t);
 	*(u_int32_t *)xdrs->x_private = htonl((u_int32_t)*lp);
 	xdrs->x_private = (char *)xdrs->x_private + sizeof(int32_t);
 	return (TRUE);
@@ -153,8 +155,9 @@
 {
 	u_int32_t l;
 
-	if ((xdrs->x_handy -= sizeof(int32_t)) < 0)
+	if (xdrs->x_handy < sizeof(int32_t))
 		return (FALSE);
+	xdrs->x_handy -= sizeof(int32_t);
 	memmove(&l, xdrs->x_private, sizeof(int32_t));
 	*lp = ntohl(l);
 	xdrs->x_private = (char *)xdrs->x_private + sizeof(int32_t);
@@ -168,8 +171,9 @@
 {
 	u_int32_t l;
 
-	if ((xdrs->x_handy -= sizeof(int32_t)) < 0)
+	if (xdrs->x_handy < sizeof(int32_t))
 		return (FALSE);
+	xdrs->x_handy -= sizeof(int32_t);
 	l = htonl((u_int32_t)*lp);
 	memmove(xdrs->x_private, &l, sizeof(int32_t));
 	xdrs->x_private = (char *)xdrs->x_private + sizeof(int32_t);
@@ -183,8 +187,9 @@
 	u_int len;
 {
 
-	if ((xdrs->x_handy -= len) < 0)
+	if (xdrs->x_handy < len)
 		return (FALSE);
+	xdrs->x_handy -= len;
 	memmove(addr, xdrs->x_private, len);
 	xdrs->x_private = (char *)xdrs->x_private + len;
 	return (TRUE);
@@ -197,8 +202,9 @@
 	u_int len;
 {
 
-	if ((xdrs->x_handy -= len) < 0)
+	if (xdrs->x_handy < len)
 		return (FALSE);
+	xdrs->x_handy -= len;
 	memmove(xdrs->x_private, addr, len);
 	xdrs->x_private = (char *)xdrs->x_private + len;
 	return (TRUE);
@@ -221,10 +227,10 @@
 	char *newaddr = xdrs->x_base + pos;
 	char *lastaddr = (char *)xdrs->x_private + xdrs->x_handy;
 
-	if ((long)newaddr > (long)lastaddr)
+	if (newaddr > lastaddr)
 		return (FALSE);
 	xdrs->x_private = newaddr;
-	xdrs->x_handy = (int)((long)lastaddr - (long)newaddr);
+	xdrs->x_handy = (u_int)(lastaddr - newaddr); /* XXX sizeof(u_int) <? sizeof(ptrdiff_t) */
 	return (TRUE);
 }