misc/132987: unionfs_readdir has math problem

[Matthew Fleming]

>Number:         132987
>Category:       misc
>Synopsis:       unionfs_readdir has math problem
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 24 00:40:05 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Matthew Fleming
>Release:        RELENG 7.1
>Organization:
Isilon Systems
>Environment:
n/a
>Description:
It looks like unionfs_readdir() has a math problem.  My guess as to what was meant:

	if (cookies_bk != NULL) {
		/* merge cookies */
		int		size;
		u_long         *newcookies, *pos;

		size = *(ap->a_ncookies) + ncookies_bk;
		newcookies = (u_long *) malloc(size * sizeof(u_long),
		    M_TEMP, M_WAITOK);
		pos = newcookies;

		memcpy(pos, cookies_bk, ncookies_bk * sizeof(u_long));
-		pos += ncookies_bk * sizeof(u_long);
+		pos += ncookies_bk;
		memcpy(pos, *(ap->a_cookies), *(ap->a_ncookies) * sizeof(u_long));
		free(cookies_bk, M_TEMP);
		free(*(ap->a_cookies), M_TEMP);
		*(ap->a_ncookies) = size;
		*(ap->a_cookies) = newcookies;
	}

>How-To-Repeat:
n/a
>Fix:
See Full Description above.

>Release-Note:
>Audit-Trail:
>Unformatted: