Check if addr_byte_count is negative. If it is negative the call to memcpy() will fail. In that case return KERN_INVALID_ARGUMENT.
* device/net_io.c (net_getstat): Check if addr_byte_count is negative. --- device/net_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/device/net_io.c b/device/net_io.c index b3ec292..f437340 100644 --- a/device/net_io.c +++ b/device/net_io.c @@ -1404,7 +1404,8 @@ net_getstat(ifp, flavor, status, count) int addr_int_count; int i; - addr_byte_count = ifp->if_address_size; + if ((addr_byte_count = ifp->if_address_size) < 0) + return KERN_INVALID_ARGUMENT; addr_int_count = (addr_byte_count + (sizeof(int)-1)) / sizeof(int); -- 1.8.1.4