DragonFlyBSD Kernel Audit
DF-1954 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/sound/pcm/sndstat.c b/sys/dev/sound/pcm/sndstat.c
--- a/sys/dev/sound/pcm/sndstat.c
+++ b/sys/dev/sound/pcm/sndstat.c
@@ -203,7 +203,11 @@
 		sndstat_buflen = sbuf_len(&sndstat_sbuf);
 	}
 
-	l = min(buf->uio_resid, sndstat_buflen - buf->uio_offset);
+	if (buf->uio_offset < 0 || buf->uio_offset >= (off_t)sndstat_buflen) {
+		l = 0;
+	} else {
+		l = min(buf->uio_resid, (size_t)(sndstat_buflen - buf->uio_offset));
+	}
 	err = (l > 0)? uiomove(sbuf_data(&sndstat_sbuf) + buf->uio_offset, l, buf) : 0;
 	lockmgr(&sndstat_lock, LK_RELEASE);