DragonFlyBSD Kernel Audit
DF-0147 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/vfs_quota.c b/sys/kern/vfs_quota.c
--- a/sys/kern/vfs_quota.c
+++ b/sys/kern/vfs_quota.c
@@ -155,6 +155,10 @@
 	ufind.left_bits = (uid >> ACCT_CHUNK_BITS);
 	gfind.left_bits = (gid >> ACCT_CHUNK_BITS);
 
+	/* Reject deltas that would wrap the unsigned byte counters. */
+	if (delta < 0 && (uint64_t)(-delta) > mp->mnt_acct.ac_bytes)
+		return;
+
 	spin_lock(&mp->mnt_acct.ac_spin);
 
 	mp->mnt_acct.ac_bytes += delta;