⬢ DragonFlyBSD Kernel Audit
DF-4535 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/misc/lpt/lpt.c
+++ b/sys/dev/misc/lpt/lpt.c
@@ -760,7 +760,13 @@ lptwrite(struct dev_write_args *ap)
 	sc->sc_state &= ~INTERRUPTED;
 	while ((n = (unsigned)szmin(BUFSIZE, uio->uio_resid)) != 0) {
 		sc->sc_cp = sc->sc_inbuf;
-		uiomove(sc->sc_cp, (size_t)n, uio);
+		if ((err = uiomove(sc->sc_cp, (size_t)n, uio)) != 0) {
+			/* do not transmit the stale contents of sc_inbuf
+			 * beyond what was actually copied, and do not
+			 * loop forever on a persistently faulting buffer */
+			sc->sc_xfercnt = 0;
+			return (err);
+		}
 		sc->sc_xfercnt = n;
 
 		if (sc->sc_irq & LP_ENABLE_EXT) {