6538819 ict_tcgeta() accesses lx_termio.c_cc[LX_VEOL] which doesn't exist

2 files changed, 42 insertions, 39 deletions

diff --git a/usr/src/lib/brand/lx/lx_brand/common/ioctl.c b/usr/src/lib/brand/lx/lx_brand/common/ioctl.c
index f9b2668700..600786f652 100644
--- a/usr/src/lib/brand/lx/lx_brand/common/ioctl.c
+++ b/usr/src/lib/brand/lx/lx_brand/common/ioctl.c
@@ -1242,17 +1242,17 @@ static int
 ict_tcgets_emulate(int fd, struct stat *stat,
     int cmd, char *cmd_str, intptr_t arg)
 {
-	struct lx_termios	l_tio, *l_tiop = (struct lx_termios *)arg;
-	struct termios		s_tio;
+	struct lx_termios	l_tios, *l_tiosp = (struct lx_termios *)arg;
+	struct termios		s_tios;
 
 	assert(cmd == LX_TCGETS);
 
-	if (syscall(SYS_brand, B_TTYMODES, &s_tio) < 0)
+	if (syscall(SYS_brand, B_TTYMODES, &s_tios) < 0)
 		return (-errno);
 
 	/* Now munge the data to how Linux wants it. */
-	s2l_termios(&s_tio, &l_tio);
-	if (uucopy(&l_tio, l_tiop, sizeof (l_tio)) != 0)
+	s2l_termios(&s_tios, &l_tios);
+	if (uucopy(&l_tios, l_tiosp, sizeof (l_tios)) != 0)
 		return (-errno);
 
 	return (0);
@@ -1263,8 +1263,8 @@ static int
 ict_tcgets_native(int fd, struct stat *stat,
     int cmd, char *cmd_str, intptr_t arg)
 {
-	struct lx_termios	l_tio, *l_tiop = (struct lx_termios *)arg;
-	struct termios		s_tio;
+	struct lx_termios	l_tios, *l_tiosp = (struct lx_termios *)arg;
+	struct termios		s_tios;
 	struct lx_cc		lio;
 	int			ldlinux;
 
@@ -1275,34 +1275,30 @@ ict_tcgets_native(int fd, struct stat *stat,
 
 	lx_debug("\tioctl(%d, 0x%x - %s, ...)",
 	    fd, TCGETS, "TCGETS");
-	if (ioctl(fd, TCGETS, (intptr_t)&s_tio) < 0)
+	if (ioctl(fd, TCGETS, (intptr_t)&s_tios) < 0)
 		return (-errno);
 
 	/* Now munge the data to how Linux wants it. */
-	s2l_termios(&s_tio, &l_tio);
-
-	/* Copy out the data. */
-	if (uucopy(&l_tio, l_tiop, sizeof (l_tio)) != 0)
-		return (-errno);
+	s2l_termios(&s_tios, &l_tios);
 
 	/*
 	 * The TIOCSETLD/TIOCGETLD ioctls are only supported by the
 	 * ldlinux strmod.  So make sure the module exists on the
 	 * target stream before we invoke the ioctl.
 	 */
-	if (ldlinux == 0)
-		return (0);
-
-	if (ioctl_istr(fd, TIOCGETLD, "TIOCGETLD", &lio, sizeof (lio)) < 0)
-		return (-errno);
+	if (ldlinux != 0) {
+		if (ioctl_istr(fd, TIOCGETLD, "TIOCGETLD",
+		    &lio, sizeof (lio)) < 0)
+			return (-errno);
 
-	l_tio.c_cc[LX_VEOF] = lio.veof;
-	l_tio.c_cc[LX_VEOL] = lio.veol;
-	l_tio.c_cc[LX_VMIN] = lio.vmin;
-	l_tio.c_cc[LX_VTIME] = lio.vtime;
+		l_tios.c_cc[LX_VEOF] = lio.veof;
+		l_tios.c_cc[LX_VEOL] = lio.veol;
+		l_tios.c_cc[LX_VMIN] = lio.vmin;
+		l_tios.c_cc[LX_VTIME] = lio.vtime;
+	}
 
 	/* Copy out the data. */
-	if (uucopy(&l_tio, l_tiop, sizeof (l_tio)) != 0)
+	if (uucopy(&l_tios, l_tiosp, sizeof (l_tios)) != 0)
 		return (-errno);
 
 	return (0);
@@ -1330,25 +1326,20 @@ ict_tcgeta(int fd, struct stat *stat, int cmd, char *cmd_str, intptr_t arg)
 	/* Now munge the data to how Linux wants it. */
 	s2l_termio(&s_tio, &l_tio);
 
-	/* Copy out the data. */
-	if (uucopy(&l_tio, l_tiop, sizeof (l_tio)) != 0)
-		return (-errno);
-
 	/*
 	 * The TIOCSETLD/TIOCGETLD ioctls are only supported by the
 	 * ldlinux strmod.  So make sure the module exists on the
 	 * target stream before we invoke the ioctl.
 	 */
-	if (ldlinux == 0)
-		return (0);
-
-	if (ioctl_istr(fd, TIOCGETLD, "TIOCGETLD", &lio, sizeof (lio)) < 0)
-		return (-errno);
+	if (ldlinux != 0) {
+		if (ioctl_istr(fd, TIOCGETLD, "TIOCGETLD",
+		    &lio, sizeof (lio)) < 0)
+			return (-errno);
 
-	l_tio.c_cc[LX_VEOF] = lio.veof;
-	l_tio.c_cc[LX_VEOL] = lio.veol;
-	l_tio.c_cc[LX_VMIN] = lio.vmin;
-	l_tio.c_cc[LX_VTIME] = lio.vtime;
+		l_tio.c_cc[LX_VEOF] = lio.veof;
+		l_tio.c_cc[LX_VMIN] = lio.vmin;
+		l_tio.c_cc[LX_VTIME] = lio.vtime;
+	}
 
 	/* Copy out the data. */
 	if (uucopy(&l_tio, l_tiop, sizeof (l_tio)) != 0)
diff --git a/usr/src/lib/brand/lx/lx_brand/sys/lx_ioctl.h b/usr/src/lib/brand/lx/lx_brand/sys/lx_ioctl.h
index 77e784808a..01bfb9499f 100644
--- a/usr/src/lib/brand/lx/lx_brand/sys/lx_ioctl.h
+++ b/usr/src/lib/brand/lx/lx_brand/sys/lx_ioctl.h
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -34,7 +34,14 @@ extern "C" {
 
 extern int lx_ioctl_init(void);
 
+/*
+ * LX_NCC must be different from LX_NCCS since while the termio and termios
+ * structures may look similar they are fundamentally different sizes and
+ * have different members.
+ */
 #define	LX_NCC	8
+#define	LX_NCCS	19
+
 struct lx_termio {
 	unsigned short c_iflag;		/* input mode flags */
 	unsigned short c_oflag;		/* output mode flags */
@@ -44,7 +51,6 @@ struct lx_termio {
 	unsigned char c_cc[LX_NCC];	/* control characters */
 };
 
-#define	LX_NCCS 19
 struct lx_termios {
 	uint32_t c_iflag;		/* input mode flags */
 	uint32_t c_oflag;		/* output mode flags */
@@ -54,7 +60,9 @@ struct lx_termios {
 	unsigned char c_cc[LX_NCCS];	/* control characters */
 };
 
-/* c_cc characters */
+/*
+ * c_cc characters which are valid for lx_termio and lx_termios
+ */
 #define	LX_VINTR	0
 #define	LX_VQUIT	1
 #define	LX_VERASE	2
@@ -63,6 +71,10 @@ struct lx_termios {
 #define	LX_VTIME	5
 #define	LX_VMIN		6
 #define	LX_VSWTC	7
+
+/*
+ * c_cc characters which are valid for lx_termios
+ */
 #define	LX_VSTART	8
 #define	LX_VSTOP	9
 #define	LX_VSUSP	10