blob: c16b2b33772e280ccf8c8dd688cefd8002e059a0 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Index: sys/i386/i386/sys_machdep.c
===================================================================
RCS file: /home/ncvs/src/sys/i386/i386/sys_machdep.c,v
retrieving revision 1.100
diff -u -p -r1.100 sys_machdep.c
--- sys/i386/i386/sys_machdep.c 19 Apr 2005 13:52:27 -0000 1.100
+++ sys/i386/i386/sys_machdep.c 4 May 2005 00:39:36 -0000
@@ -476,10 +476,6 @@ i386_get_ldt(td, uap)
uap->start, uap->num, (void *)uap->descs);
#endif
- /* verify range of LDTs exist */
- if ((uap->start < 0) || (uap->num <= 0))
- return(EINVAL);
-
if (pldt) {
nldt = pldt->ldt_len;
num = min(uap->num, nldt);
@@ -489,7 +485,10 @@ i386_get_ldt(td, uap)
num = min(uap->num, nldt);
lp = &ldt[uap->start];
}
- if (uap->start + num > nldt)
+
+ if ((uap->start > (unsigned int)nldt) ||
+ ((unsigned int)num > (unsigned int)nldt) ||
+ ((unsigned int)(uap->start + num) > (unsigned int)nldt))
return(EINVAL);
error = copyout(lp, uap->descs, num * sizeof(union descriptor));
|
