Skip to content

Commit

Permalink
ptyfs: Don't copy out cookies past end of buffer.
Browse files Browse the repository at this point in the history 
Reported-by: syzbot+2aae7c4eddc796f917e6@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=5fe24c1da952ac2ea498d745d6479bc6be91a751
  • Loading branch information
riastradh authored and riastradh committed Aug 5, 2022
1 parent 5c23615 commit bd3b975
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions sys/fs/ptyfs/ptyfs_vnops.c
View file
@@ -1,4 +1,4 @@
/* $NetBSD: ptyfs_vnops.c,v 1.68 2021/12/08 20:11:54 andvar Exp $ */
/* $NetBSD: ptyfs_vnops.c,v 1.69 2022/08/05 10:36:02 riastradh Exp $ */

/*
* Copyright (c) 1993, 1995
Expand Down Expand Up @@ -76,7 +76,7 @@
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: ptyfs_vnops.c,v 1.68 2021/12/08 20:11:54 andvar Exp $");
__KERNEL_RCSID(0, "$NetBSD: ptyfs_vnops.c,v 1.69 2022/08/05 10:36:02 riastradh Exp $");

#include <sys/param.h>
#include <sys/systm.h>
Expand Down Expand Up @@ -691,7 +691,7 @@ ptyfs_readdir(void *v)
*ap->a_cookies = cookies;
}

for (; i < 2; i++) {
for (; i < 2 && uio->uio_resid >= UIO_MX; i++) {
/* `.' and/or `..' */
dp->d_fileno = PTYFS_FILENO(PTYFSroot, 0);
dp->d_namlen = i + 1;
Expand Down

0 comments on commit bd3b975

Please sign in to comment.