DragonFlyBSD Kernel Audit
DF-1700 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/vn/vn.c b/sys/dev/disk/vn/vn.c
--- a/sys/dev/disk/vn/vn.c
+++ b/sys/dev/disk/vn/vn.c
@@ -556,8 +556,11 @@
 	 * If the size is specified, override the file attributes.  Note that
 	 * the vn_size argument is in PAGE_SIZE sized blocks.
 	 */
-	if (vio->vn_size)
+	if (vio->vn_size) {
+		if (vio->vn_size > INT64_MAX / PAGE_SIZE)
+			return (EINVAL);
 		vn->sc_size = vio->vn_size * PAGE_SIZE / vn->sc_secsize;
+	}
 	else
 		vn->sc_size = vattr.va_size / vn->sc_secsize;
 	error = vnsetcred(vn, cred);