mirror of
https://git.FreeBSD.org/src.git
synced 2024-12-16 10:20:30 +00:00
pipe_create has to zero out the select record earlier to avoid
returning a half-initialized pipe and causing pipeclose() to follow a junk pointer. Discovered by: "Nick S" <snicko@noid.org>
This commit is contained in:
parent
268511689c
commit
82a283fcf3
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=76754
@ -306,6 +306,7 @@ pipe_create(cpipep)
|
||||
* protect so pipeclose() doesn't follow a junk pointer
|
||||
* if pipespace() fails.
|
||||
*/
|
||||
bzero(&cpipe->pipe_sel, sizeof(cpipe->pipe_sel));
|
||||
cpipe->pipe_state = 0;
|
||||
cpipe->pipe_peer = NULL;
|
||||
cpipe->pipe_busy = 0;
|
||||
@ -329,7 +330,6 @@ pipe_create(cpipep)
|
||||
vfs_timestamp(&cpipe->pipe_ctime);
|
||||
cpipe->pipe_atime = cpipe->pipe_ctime;
|
||||
cpipe->pipe_mtime = cpipe->pipe_ctime;
|
||||
bzero(&cpipe->pipe_sel, sizeof cpipe->pipe_sel);
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user