xnu-7195.101.1.tar.gz

[apple/xnu.git] / bsd / dev / arm / stubs.c

diff --git a/bsd/dev/arm/stubs.c b/bsd/dev/arm/stubs.c
index 644dae6304fffed22726c90c650327612edfb898..bf61083c2d98b685f82deeb9244b64abcae5beb9 100644 (file)
--- a/bsd/dev/arm/stubs.c
+++ b/bsd/dev/arm/stubs.c
@@ -7,6 +7,7 @@
  *
  */
 
+#include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/ioctl.h>
@@ -15,11 +16,13 @@
 #include <sys/kauth.h>
 #include <sys/ucred.h>
 #include <sys/proc_internal.h>
+#include <sys/sysproto.h>
 #include <sys/user.h>
 #include <kern/task.h>
 #include <kern/thread.h>
 #include <vm/vm_map.h>
 
+
 /*
  * copy a null terminated string from the kernel address space into the user
  * address space. - if the user is denied write access, return EFAULT. - if
@@ -33,15 +36,21 @@ copyoutstr(const void *from, user_addr_t to, size_t maxlen, size_t * lencopied)
 {
        size_t          slen;
        size_t          len;
-       int             error = 0;
+       int             error = copyoutstr_prevalidate(from, to, maxlen);
+
+       if (__improbable(error)) {
+               return error;
+       }
 
        slen = strlen(from) + 1;
-       if (slen > maxlen)
+       if (slen > maxlen) {
                error = ENAMETOOLONG;
+       }
 
-       len = min(maxlen, slen);
-       if (copyout(from, to, len))
+       len = MIN(maxlen, slen);
+       if (copyout(from, to, len)) {
                error = EFAULT;
+       }
        *lencopied = len;
 
        return error;
@@ -65,13 +74,15 @@ copystr(const void *vfrom, void *vto, size_t maxlen, size_t * lencopied)
 
        for (l = 0; l < maxlen; l++) {
                if ((*to++ = *from++) == '\0') {
-                       if (lencopied)
+                       if (lencopied) {
                                *lencopied = l + 1;
+                       }
                        return 0;
                }
        }
-       if (lencopied)
+       if (lencopied) {
                *lencopied = maxlen;
+       }
        return ENAMETOOLONG;
 }
 
@@ -81,3 +92,4 @@ copywithin(void *src, void *dst, size_t count)
        bcopy(src, dst, count);
        return 0;
 }
+