From: guenther <guenther@openbsd.org>
Date: Thu, 14 Jul 2016 03:34:28 +0000 (+0000)
Subject: ufs_readdir() buffer was meant to be limited to 64kB; reversed test
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=14ec9cbc94f7a5c3ed77756f8d4cfae76bfc6a20;p=openbsd

ufs_readdir() buffer was meant to be limited to 64kB; reversed test
permitted very big mallocs to panic the kernel.

reported by Tim Newsham
ok millert@
---

diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c
index 81c2132e60d..30fafc3f8b7 100644
--- a/sys/ufs/ufs/ufs_vnops.c
+++ b/sys/ufs/ufs/ufs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufs_vnops.c,v 1.128 2016/06/19 11:54:34 natano Exp $	*/
+/*	$OpenBSD: ufs_vnops.c,v 1.129 2016/07/14 03:34:28 guenther Exp $	*/
 /*	$NetBSD: ufs_vnops.c,v 1.18 1996/05/11 18:28:04 mycroft Exp $	*/
 
 /*
@@ -1441,7 +1441,7 @@ ufs_readdir(void *v)
 	 */
 
 	/* read from disk, stopping on a block boundary, max 64kB */
-	readcnt = max(count, 64*1024) - entries;
+	readcnt = min(count, 64*1024) - entries;
 
 	auio = *uio;
 	auio.uio_iov = &aiov;