D21232.diff
No OneTemporary
Actions

Size

499 B

Referenced Files

None

Subscribers

None

D21232.diff
View Options

	Index: stable/12/sys/fs/nandfs/nandfs_dat.c
	===================================================================
	--- stable/12/sys/fs/nandfs/nandfs_dat.c
	+++ stable/12/sys/fs/nandfs/nandfs_dat.c
	@@ -298,6 +298,9 @@
	size_t size;
	int error;

	+ if (nargv->nv_nmembs >= SIZE_MAX / sizeof(struct nandfs_bdesc))
	+ return (EINVAL);
	+
	size = nargv->nv_nmembs * sizeof(struct nandfs_bdesc);
	bd = malloc(size, M_NANDFSTEMP, M_WAITOK);
	error = copyin((void *)(uintptr_t)nargv->nv_base, bd, size);