ufs_readdir() buffer was meant to be limited to 64kB; reversed test

permitted very big mallocs to panic the kernel.

reported by Tim Newsham
ok millert@

diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c
index 81c2132..30fafc3 100644 (file)
--- a/sys/ufs/ufs/ufs_vnops.c
+++ b/sys/ufs/ufs/ufs_vnops.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ufs_vnops.c,v 1.128 2016/06/19 11:54:34 natano Exp $  */
+/*     $OpenBSD: ufs_vnops.c,v 1.129 2016/07/14 03:34:28 guenther Exp $        */
 /*     $NetBSD: ufs_vnops.c,v 1.18 1996/05/11 18:28:04 mycroft Exp $   */
 
 /*
@@ -1441,7 +1441,7 @@ ufs_readdir(void *v)
         */
 
        /* read from disk, stopping on a block boundary, max 64kB */
-       readcnt = max(count, 64*1024) - entries;
+       readcnt = min(count, 64*1024) - entries;
 
        auio = *uio;
        auio.uio_iov = &aiov;