Check if member io_count is non-negative. If it is negative the cast
to vm_size_t will fail. In that case return FALSE.

* device/dev_pager.c (device_pager_data_request_done): Check if member io_count 
is non-negative.
(device_pager_data_request_done) (io_count): Cast to vm_size_t.

---
 device/dev_pager.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/device/dev_pager.c b/device/dev_pager.c
index 35c79b3..a5dba3f 100644
--- a/device/dev_pager.c
+++ b/device/dev_pager.c
@@ -417,7 +417,10 @@ boolean_t device_pager_data_request_done(io_req_t  ior)
        vm_size_t       size_read;
 
        if (ior->io_error == D_SUCCESS) {
-           size_read = ior->io_count;
+           if (ior->io_count >= 0)
+               size_read = (vm_size_t)ior->io_count;
+           else
+               return FALSE;
            if (ior->io_residual) {
                if (device_pager_debug)
                    printf("(device_pager)data_request_done: r: 0x%lx\n", 
ior->io_residual);
-- 
1.8.1.4


Reply via email to