DragonFlyBSD Kernel Audit
DF-2859 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/subr_sglist.c b/sys/kern/subr_sglist.c
--- a/sys/kern/subr_sglist.c
+++ b/sys/kern/subr_sglist.c
@@ -570,8 +570,8 @@ sglist_split(struct sglist *original, struct sglist **head, size_t length,
 
 	/* Trim 'count' entries from the front of 'original'. */
 	original->sg_nseg -= count;
-	bcopy(original->sg_segs + count, original->sg_segs, count *
-	    sizeof(struct sglist_seg));
+	bcopy(original->sg_segs + count, original->sg_segs,
+	    original->sg_nseg * sizeof(struct sglist_seg));
 	return (0);
 }