diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2024-07-17 14:33:53 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-08-08 18:16:26 +0000 |
| commit | d8ff42e816848a0d4a427755b46b8560cb86ebc8 (patch) | |
| tree | 18597e037d2ab4bc500a5a34a32780f96c69844a | |
| parent | ad0d39ecc90f116a714e996d8fa43b747e5d8808 (diff) | |
| download | src-d8ff42e816848a0d4a427755b46b8560cb86ebc8.tar.gz src-d8ff42e816848a0d4a427755b46b8560cb86ebc8.zip | |
pipe: keep uio_iovcnt consistent
In pipe_build_write_buffer we increment uio_iov but did not update
uio_iovcnt. This would not cause an OOB read (thanks to to uio_resid)
but is inconsistent and could be an issue if other code changes are made
in the future.
Reported by: Synacktiv
Reviewed by: jhb, markj, brooks
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D45999
| -rw-r--r-- | sys/kern/sys_pipe.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c index 70b2a03e0140..73b6facec6c7 100644 --- a/sys/kern/sys_pipe.c +++ b/sys/kern/sys_pipe.c @@ -941,8 +941,10 @@ pipe_build_write_buffer(struct pipe *wpipe, struct uio *uio) uio->uio_iov->iov_len -= size; uio->uio_iov->iov_base = (char *)uio->uio_iov->iov_base + size; - if (uio->uio_iov->iov_len == 0) + if (uio->uio_iov->iov_len == 0) { uio->uio_iov++; + uio->uio_iovcnt--; + } uio->uio_resid -= size; uio->uio_offset += size; return (0); |