diff options
| author | pooka <pooka@NetBSD.org> | 2007-11-12 17:42:13 +0000 |
|---|---|---|
| committer | pooka <pooka@NetBSD.org> | 2007-11-12 17:42:13 +0000 |
| commit | ca28ea4509d0afbcada5d15284b1ce9b261c8cdf (patch) | |
| tree | 0f25e178649729b0c398f6a0ce72402b51a526e0 /sys/dev/putter | |
| parent | 805571cfce42ea413da853e365fcae71194bf4e3 (diff) | |
Bounds-check responses from userspace.
Diffstat (limited to 'sys/dev/putter')
| -rw-r--r-- | sys/dev/putter/putter.c | 7 | ||||
| -rw-r--r-- | sys/dev/putter/putter_sys.h | 4 |
2 files changed, 6 insertions, 5 deletions
diff --git a/sys/dev/putter/putter.c b/sys/dev/putter/putter.c index 19ba742f5d5..35277d38594 100644 --- a/sys/dev/putter/putter.c +++ b/sys/dev/putter/putter.c @@ -1,4 +1,4 @@ -/* $NetBSD: putter.c,v 1.2 2007/11/12 16:39:33 pooka Exp $ */ +/* $NetBSD: putter.c,v 1.3 2007/11/12 17:42:13 pooka Exp $ */ /* * Copyright (c) 2006, 2007 Antti Kantee. All Rights Reserved. @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: putter.c,v 1.2 2007/11/12 16:39:33 pooka Exp $"); +__KERNEL_RCSID(0, "$NetBSD: putter.c,v 1.3 2007/11/12 17:42:13 pooka Exp $"); #include <sys/param.h> #include <sys/conf.h> @@ -211,7 +211,8 @@ putter_fop_write(struct file *fp, off_t *off, struct uio *uio, memcpy(buf, &pth, sizeof(pth)); error = uiomove(buf+sizeof(struct putter_hdr), frsize, uio); if (error == 0) { - pi->pi_pop->pop_dispatch(pi->pi_private, buf); + pi->pi_pop->pop_dispatch(pi->pi_private, + (struct putter_hdr *)buf); } kmem_free(buf, frsize + sizeof(struct putter_hdr)); diff --git a/sys/dev/putter/putter_sys.h b/sys/dev/putter/putter_sys.h index 3a346cb5b0d..426d599d0c4 100644 --- a/sys/dev/putter/putter_sys.h +++ b/sys/dev/putter/putter_sys.h @@ -1,4 +1,4 @@ -/* $NetBSD: putter_sys.h,v 1.1 2007/11/12 16:39:33 pooka Exp $ */ +/* $NetBSD: putter_sys.h,v 1.2 2007/11/12 17:42:13 pooka Exp $ */ /* * Copyright (c) 2007 Antti Kantee. All Rights Reserved. @@ -40,7 +40,7 @@ struct putter_ops { int (*pop_getout)(void *, size_t, int, uint8_t **,size_t *,void **); void (*pop_releaseout)(void *, void *, int); size_t (*pop_waitcount)(void *); - int (*pop_dispatch)(void *, uint8_t *); + int (*pop_dispatch)(void *, struct putter_hdr *); int (*pop_close)(void *); }; |
