 @@ -1,14 +1,14 @@
-/*	$NetBSD: vnd.c,v 1.232.2.3.2.1 2016/01/02 14:38:45 riz Exp $	*/
+/*	$NetBSD: vnd.c,v 1.232.2.3.2.2 2017/08/19 05:19:28 snj Exp $	*/
 /*-
  * Copyright (c) 1996, 1997, 1998, 2008 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Jason R. Thorpe.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -81,27 +81,27 @@
  * systems where the block-level operations are not implemented for
  * whatever reason.
+ *
  * NOTE 2: There is a security issue involved with this driver.
  * Once mounted all access to the contents of the "mapped" file via
  * the special file is controlled by the permissions on the special
  * file, the protection of the mapped file is ignored (effectively,
  * by using root credentials in all transactions).
+ *
  * NOTE 3: Doesn't interact with leases, should it?
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.232.2.3.2.1 2016/01/02 14:38:45 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.232.2.3.2.2 2017/08/19 05:19:28 snj Exp $");
 #if defined(_KERNEL_OPT)
 #include "opt_vnd.h"
 #include "opt_compat_netbsd.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/namei.h>
 #include <sys/proc.h>
 #include <sys/kthread.h>
 #include <sys/errno.h>
 #include <sys/buf.h>
 @@ -1228,51 +1228,78 @@ vndioctl(dev_t dev, u_long cmd, void *da
 			/* allocate space for compresed file header */
 			ch = malloc(sizeof(struct vnd_comp_header),
 			M_TEMP, M_WAITOK);
 			/* read compressed file header */
 			error = vn_rdwr(UIO_READ, nd.ni_vp, (void *)ch,
 			  sizeof(struct vnd_comp_header), 0, UIO_SYSSPACE,
 			  IO_UNIT|IO_NODELOCKED, l->l_cred, NULL, NULL);
 			if (error) {
 				free(ch, M_TEMP);
 				VOP_UNLOCK(nd.ni_vp);
 				goto close_and_exit;
+			}
 			if (ntohl(ch->block_size) == 0 ||
 			    ntohl(ch->num_blocks) > UINT32_MAX - 1) {
 				free(ch, M_TEMP);
 				VOP_UNLOCK(nd.ni_vp);
 				goto close_and_exit;
+			}
 			/* save some header info */
 			vnd->sc_comp_blksz = ntohl(ch->block_size);
 			/* note last offset is the file byte size */
 			vnd->sc_comp_numoffs = ntohl(ch->num_blocks)+1;
 			free(ch, M_TEMP);
 			if (!DK_DEV_BSIZE_OK(vnd->sc_comp_blksz)) {
 				VOP_UNLOCK(nd.ni_vp);
 				error = EINVAL;
 				goto close_and_exit;
+			}
-			if (sizeof(struct vnd_comp_header) +
+			KASSERT(0 < vnd->sc_comp_blksz);
-			  sizeof(u_int64_t) * vnd->sc_comp_numoffs >
+			KASSERT(0 < vnd->sc_comp_numoffs);
-			  vattr.va_size) {
+			/*
 			 * @#^@!$& gcc -Wtype-limits refuses to let me
 			 * write SIZE_MAX/sizeof(uint64_t) < numoffs,
 			 * because the range of the type on amd64 makes
 			 * the comparisons always false.
 			 */
 #if SIZE_MAX <= UINT32_MAX*(64/CHAR_BIT)
 			if (SIZE_MAX/sizeof(uint64_t) < vnd->sc_comp_numoffs) {
 				VOP_UNLOCK(nd.ni_vp);
 				error = EINVAL;
 				goto close_and_exit;
+			}
 #endif
 			if ((vattr.va_size < sizeof(struct vnd_comp_header)) ||
 			    (vattr.va_size - sizeof(struct vnd_comp_header) <
 				sizeof(uint64_t)*vnd->sc_comp_numoffs) ||
 			    (UQUAD_MAX/vnd->sc_comp_blksz <
 				vnd->sc_comp_numoffs - 1)) {
 				VOP_UNLOCK(nd.ni_vp);
 				error = EINVAL;
 				goto close_and_exit;
+			}
 			/* set decompressed file size */
 			KASSERT(vnd->sc_comp_numoffs - 1 <=
 			    UQUAD_MAX/vnd->sc_comp_blksz);
 			vattr.va_size =
 			    ((u_quad_t)vnd->sc_comp_numoffs - 1) *
 			     (u_quad_t)vnd->sc_comp_blksz;
 			/* allocate space for all the compressed offsets */
 			__CTASSERT(UINT32_MAX <= UQUAD_MAX/sizeof(uint64_t));
 			vnd->sc_comp_offsets =
 			malloc(sizeof(u_int64_t) * vnd->sc_comp_numoffs,
 			M_DEVBUF, M_WAITOK);
 			/* read in the offsets */
 			error = vn_rdwr(UIO_READ, nd.ni_vp,
 			  (void *)vnd->sc_comp_offsets,
 			  sizeof(u_int64_t) * vnd->sc_comp_numoffs,
 			  sizeof(struct vnd_comp_header), UIO_SYSSPACE,
 			  IO_UNIT|IO_NODELOCKED, l->l_cred, NULL, NULL);
 			if (error) {
 				VOP_UNLOCK(nd.ni_vp);
 				goto close_and_exit;