patch-2.4.11-dontuse linux/ipc/sem.c

• Lines: 31
• Date: Sun Sep 30 12:26:42 2001
• Orig file: v2.4.10/linux/ipc/sem.c
• Orig date: Mon Feb 19 10:18:18 2001

diff -u --recursive --new-file v2.4.10/linux/ipc/sem.c linux/ipc/sem.c
@@ -53,6 +53,8 @@
  *
  * SMP-threaded, sysctl's added
  * (c) 1999 Manfred Spraul <manfreds@colorfullife.com>
+ * Enforced range limit on SEM_UNDO
+ * (c) 2001 Red Hat Inc <alan@redhat.com>
  */
 
 #include <linux/config.h>
@@ -256,8 +258,19 @@
 		curr->sempid = (curr->sempid << 16) | pid;
 		curr->semval += sem_op;
 		if (sop->sem_flg & SEM_UNDO)
-			un->semadj[sop->sem_num] -= sem_op;
-
+		{
+			int undo = un->semadj[sop->sem_num] - sem_op;
+			/*
+	 		 *	Exceeding the undo range is an error.
+			 */
+			if (undo < (-SEMAEM - 1) || undo > SEMAEM)
+			{
+				/* Don't undo the undo */
+				sop->sem_flg &= ~SEM_UNDO;
+				goto out_of_range;
+			}
+			un->semadj[sop->sem_num] = undo;
+		}
 		if (curr->semval < 0)
 			goto would_block;
 		if (curr->semval > SEMVMX)