DragonFlyBSD Kernel Audit
DF-2837 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -686,16 +686,17 @@ soreserve(struct socket *so, u_long sndcc, u_long rcvcc, struct rlimit *rl)
 static int
 sysctl_handle_sb_max(SYSCTL_HANDLER_ARGS)
 {
 	int error = 0;
 	u_long old_sb_max = sb_max;
+	int tmp;
 
-	error = SYSCTL_OUT(req, arg1, sizeof(int));
+	tmp = (int)sb_max;
+	error = SYSCTL_OUT(req, &tmp, sizeof(tmp));
 	if (error || !req->newptr)
 		return (error);
-	error = SYSCTL_IN(req, arg1, sizeof(int));
+	error = SYSCTL_IN(req, &tmp, sizeof(tmp));
 	if (error)
 		return (error);
+	sb_max = (u_long)tmp;
 	if (sb_max < MSIZE + MCLBYTES) {
 		sb_max = old_sb_max;
 		return (EINVAL);