⬢ DragonFlyBSD Kernel Audit
DF-2440 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
--- a/sys/dev/disk/dm/delay/dm_target_delay.c
+++ b/sys/dev/disk/dm/delay/dm_target_delay.c
@@ -70,7 +70,7 @@
 } dm_target_delay_config_t;
 
 static int _init(struct dm_delay_info*, char**, int);
-static int _table(struct dm_delay_info*, char*);
+static int _table(struct dm_delay_info*, char*, size_t);
 static void _strategy(struct dm_delay_info*, struct buf*);
 static __inline void _submit(struct dm_delay_info*, struct buf*);
 static void _submit_queue(struct dm_delay_info*, int);
@@ -182,20 +182,20 @@
 
 	params = dm_alloc_string(DM_MAX_PARAMS_SIZE);
 	p = params;
-	p += _table(&tdc->read, p);
+	p += _table(&tdc->read, p, DM_MAX_PARAMS_SIZE);
 	if (tdc->argc == 6) {
-		p += ksnprintf(p, DM_MAX_PARAMS_SIZE, " ");
-		_table(&tdc->write, p);
+		p += ksnprintf(p, DM_MAX_PARAMS_SIZE - (p - params), " ");
+		p += _table(&tdc->write, p, DM_MAX_PARAMS_SIZE - (p - params));
 	}
 
 	return params;
 }
 
-static int _table(struct dm_delay_info *di, char *p)
+static int _table(struct dm_delay_info *di, char *p, size_t limit)
 {
 	int ret;
 
-	ret = ksnprintf(p, DM_MAX_PARAMS_SIZE,
+	ret = ksnprintf(p, limit,
 		"%s %" PRIu64 " %d",
 		di->pdev->udev_name, di->offset, di->delay);
 	return ret;