From 14ec9cbc94f7a5c3ed77756f8d4cfae76bfc6a20 Mon Sep 17 00:00:00 2001
From: guenther <guenther@openbsd.org>
Date: Thu, 14 Jul 2016 03:34:28 +0000
Subject: [PATCH] ufs_readdir() buffer was meant to be limited to 64kB;
 reversed test permitted very big mallocs to panic the kernel.

reported by Tim Newsham
ok millert@
---
 sys/ufs/ufs/ufs_vnops.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c
index 81c2132e60d..30fafc3f8b7 100644
--- a/sys/ufs/ufs/ufs_vnops.c
+++ b/sys/ufs/ufs/ufs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufs_vnops.c,v 1.128 2016/06/19 11:54:34 natano Exp $	*/
+/*	$OpenBSD: ufs_vnops.c,v 1.129 2016/07/14 03:34:28 guenther Exp $	*/
 /*	$NetBSD: ufs_vnops.c,v 1.18 1996/05/11 18:28:04 mycroft Exp $	*/
 
 /*
@@ -1441,7 +1441,7 @@ ufs_readdir(void *v)
 	 */
 
 	/* read from disk, stopping on a block boundary, max 64kB */
-	readcnt = max(count, 64*1024) - entries;
+	readcnt = min(count, 64*1024) - entries;
 
 	auio = *uio;
 	auio.uio_iov = &aiov;
-- 
2.20.1