Ticket #3124: patch.1.diff

src/system/kernel/fs/vfs.cpp

@@ -5470 +5470 @@
             return B_BAD_ADDRESS;
 
         ASSERT(entry->d_reclen >= sizeof(struct dirent));
+        ASSERT(entry->d_reclen <= sizeof(buffer));
 
         if (user_memcpy(entry->d_name, userEntry->d_name,
-                entry->d_reclen - sizeof(struct dirent)) != B_OK)
+                entry->d_reclen - sizeof(struct dirent) + 1) != B_OK)
             return B_BAD_ADDRESS;
     } else
         entry = userEntry;

src/libs/compat/freebsd_network/if.c

@@ -67 +67 @@
 void
 if_free(struct ifnet *ifp)
 {
+    int clear;
+    // if_index may be uninitialized
+    if (gDeviceNameList[ifp->if_index] == ifp->device_name) {
+        if (ifp->if_index == gDeviceCount - 1) {
+            clear= ifp->if_index;
+        } else {
+            clear= gDeviceCount - 1;
+            gDevices[ifp->if_index] = gDevices[clear];
+            gDeviceNameList[ifp->if_index] = gDeviceNameList[clear];
+            gDevices[ifp->if_index]->if_index = ifp->if_index;
+        }
+
+        gDeviceNameList[clear] = 0;
+        gDevices[clear] = 0;
+        gDeviceCount--;
+    }
+    
     IF_ADDR_LOCK_DESTROY(ifp);
     if (ifp->if_type == IFT_ETHER)
         _kernel_free(ifp->if_l2com);