Check if member io_count is non-negative. If it is negative the cast
to vm_size_t will fail. In that case return FALSE.
* device/dev_pager.c (device_pager_data_request_done): Check if member io_count
is non-negative.
(device_pager_data_request_done) (io_count): Cast to vm_size_t.
---
device/dev_pager.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/device/dev_pager.c b/device/dev_pager.c
index 35c79b3..a5dba3f 100644
--- a/device/dev_pager.c
+++ b/device/dev_pager.c
@@ -417,7 +417,10 @@ boolean_t device_pager_data_request_done(io_req_t ior)
vm_size_t size_read;
if (ior->io_error == D_SUCCESS) {
- size_read = ior->io_count;
+ if (ior->io_count >= 0)
+ size_read = (vm_size_t)ior->io_count;
+ else
+ return FALSE;
if (ior->io_residual) {
if (device_pager_debug)
printf("(device_pager)data_request_done: r: 0x%lx\n",
ior->io_residual);
--
1.8.1.4