xnu-3789.70.16.tar.gz

[apple/xnu.git] / osfmk / ipc / mach_kernelrpc.c

diff --git a/osfmk/ipc/mach_kernelrpc.c b/osfmk/ipc/mach_kernelrpc.c
index af9223254bf9c18556118cd3733a155b7cc2f769..b24f4d5dd2ea3947251ab2ad65ae32d0bd596e6c 100644 (file)
--- a/osfmk/ipc/mach_kernelrpc.c
+++ b/osfmk/ipc/mach_kernelrpc.c
@@ -256,6 +256,11 @@ _kernelrpc_mach_port_insert_right_trap(struct _kernelrpc_mach_port_insert_right_
        disp = ipc_object_copyin_type(args->polyPoly);
 
        rv = mach_port_insert_right(task->itk_space, args->name, port, disp);
+       if (rv != KERN_SUCCESS) {
+               if (IO_VALID((ipc_object_t)port)) {
+                       ipc_object_destroy((ipc_object_t)port, disp);
+               }
+       }
        
 done:
        if (task)
@@ -445,7 +450,7 @@ mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_ar
        if (voucher == IV_NULL)
                return MACH_SEND_INVALID_DEST;
 
-       mach_msg_type_number_t __assert_only max_sz = sz;
+       mach_msg_type_number_t max_sz = sz;
 
        if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) {
                /* keep small recipes on the stack for speed */
@@ -461,14 +466,14 @@ mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_ar
                if (kr == KERN_SUCCESS && sz > 0)
                        kr = copyout(krecipe, (void *)args->recipe, sz);
        } else {
-               uint8_t *krecipe = kalloc((vm_size_t)sz);
+               uint8_t *krecipe = kalloc((vm_size_t)max_sz);
                if (!krecipe) {
                        kr = KERN_RESOURCE_SHORTAGE;
                        goto done;
                }
 
-               if (copyin(args->recipe, (void *)krecipe, args->recipe_size)) {
-                       kfree(krecipe, (vm_size_t)sz);
+               if (copyin(args->recipe, (void *)krecipe, sz)) {
+                       kfree(krecipe, (vm_size_t)max_sz);
                        kr = KERN_MEMORY_ERROR;
                        goto done;
                }
@@ -479,7 +484,7 @@ mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_ar
 
                if (kr == KERN_SUCCESS && sz > 0)
                        kr = copyout(krecipe, (void *)args->recipe, sz);
-               kfree(krecipe, (vm_size_t)sz);
+               kfree(krecipe, (vm_size_t)max_sz);
        }
 
        kr = copyout(&sz, args->recipe_size, sizeof(sz));