⬢ DragonFlyBSD Kernel Audit
DF-2656 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
--- a/sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c
+++ b/sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c
@@ -236,7 +236,7 @@
         return Z_STREAM_ERROR;
     }
     if (windowBits == 8) windowBits = 9;  /* until 256-byte window bug fixed */
-    s = (deflate_state *) kmalloc(sizeof(*s), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT);
+    s = (deflate_state *) kmalloc(sizeof(*s), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT | M_ZERO);
     if (s == Z_NULL) return Z_MEM_ERROR;
     strm->state = (struct internal_state FAR *)s;
     s->strm = strm;
@@ -251,15 +251,15 @@
     s->hash_mask = s->hash_size - 1;
     s->hash_shift =  ((s->hash_bits+MIN_MATCH-1)/MIN_MATCH);
 
-    s->window = (Bytef *) kmalloc((s->w_size)*2*sizeof(Byte), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT);
-    s->prev   = (Posf *)  kmalloc((s->w_size)*sizeof(Pos), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT);
-    s->head   = (Posf *)  kmalloc((s->hash_size)*sizeof(Pos), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT);
+    s->window = (Bytef *) kmalloc((s->w_size)*2*sizeof(Byte), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT | M_ZERO);
+    s->prev   = (Posf *)  kmalloc((s->w_size)*sizeof(Pos), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT | M_ZERO);
+    s->head   = (Posf *)  kmalloc((s->hash_size)*sizeof(Pos), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT | M_ZERO);
 
     s->high_water = 0;      /* nothing written to s->window yet */
 
     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
 
-    overlay = (ushf *) kmalloc((s->lit_bufsize)*(sizeof(ush)+2), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT);
+    overlay = (ushf *) kmalloc((s->lit_bufsize)*(sizeof(ush)+2), C_ZLIB_BUFFER_DEFLATE, M_INTWAIT | M_ZERO);
     s->pending_buf = (uchf *) overlay;
     s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);