since size_t is unsigned must check for overflow incrementally (from karels)

SCCS-vsn: sys/kern/uipc_syscalls.c 8.5

diff --git a/usr/src/sys/kern/uipc_syscalls.c b/usr/src/sys/kern/uipc_syscalls.c
index f4893a1..158aaca 100644 (file)
--- a/usr/src/sys/kern/uipc_syscalls.c
+++ b/usr/src/sys/kern/uipc_syscalls.c
@@ -477,10 +477,9 @@ sendit(p, s, mp, flags, retsize)
        auio.uio_resid = 0;
        iov = mp->msg_iov;
        for (i = 0; i < mp->msg_iovlen; i++, iov++) {
        auio.uio_resid = 0;
        iov = mp->msg_iov;
        for (i = 0; i < mp->msg_iovlen; i++, iov++) {

-               if (iov->iov_len < 0)
-                       return (EINVAL);
-               if ((auio.uio_resid += iov->iov_len) < 0)
+               if (auio.uio_resid + iov->iov_len < auio.uio_resid)

                        return (EINVAL);
                        return (EINVAL);

+               auio.uio_resid += iov->iov_len;

        }
        if (mp->msg_name) {
                if (error = sockargs(&to, mp->msg_name, mp->msg_namelen,
        }
        if (mp->msg_name) {
                if (error = sockargs(&to, mp->msg_name, mp->msg_namelen,


@@ -742,10 +741,9 @@ recvit(p, s, mp, namelenp, retsize)
        auio.uio_resid = 0;
        iov = mp->msg_iov;
        for (i = 0; i < mp->msg_iovlen; i++, iov++) {
        auio.uio_resid = 0;
        iov = mp->msg_iov;
        for (i = 0; i < mp->msg_iovlen; i++, iov++) {

-               if (iov->iov_len < 0)
-                       return (EINVAL);
-               if ((auio.uio_resid += iov->iov_len) < 0)
+               if (auio.uio_resid + iov->iov_len < auio.uio_resid)

                        return (EINVAL);
                        return (EINVAL);

+               auio.uio_resid += iov->iov_len;

        }
 #ifdef KTRACE
        if (KTRPOINT(p, KTR_GENIO)) {
        }
 #ifdef KTRACE
        if (KTRPOINT(p, KTR_GENIO)) {