Note: There was a bad value `low' for the field `>Severity:'.
	It was set to the default value of `serious'.

	Note: There was a bad value `non-critical' for the field `>Priority:'.
	It was set to the default value of `medium'.


>Number:         19852
>Category:       bin
>Synopsis:       Potential problem with dump and more than 2GB of memory
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jan 14 14:55:00 PST 2003
>Closed-Date:
>Last-Modified:
>Originator:     Christian Biere
>Release:        NetBSD 1.6K
>Organization:
>Environment:

>Description:

/usr/src/sbin/dump/rcache.c:

static int cachebufs;

[...]

void
initcache(int cachesize, int readblksize)
{
    size_t len;
    size_t  sharedSize;

    nblksread = (readblksize + ufsib->ufs_bsize - 1) / ufsib->ufs_bsize;
    if(cachesize == -1) {   /* Compute from memory available */
        int usermem;
        int mib[2] = { CTL_HW, HW_USERMEM };

        len = sizeof(usermem);
        if (sysctl(mib, 2, &usermem, &len, NULL, 0) < 0) {
            msg("sysctl(hw.usermem) failed: %s\n", strerror(errno));
            return;
        }

There are archs with sizeof(int) == 4 but a 64-bit address space. So, I
wonder whether the manpage for sysctl() isn't very precise or what's the
safe method for using sysctl with HW_USERMEM and HW_PHYSMEM.

        cachebufs = (usermem / MAXMEMPART) / (nblksread * dev_bsize);   

As usermem is an int cachebufs might have a negative value, now.

     } else {        /* User specified */
        cachebufs = cachesize;
    }

    if(cachebufs) { /* Don't allocate if zero --> no caching */
        if (cachebufs > MAXCACHEBUFS)
            cachebufs = MAXCACHEBUFS;

cachebufs might still have a negative value.

        sharedSize = sizeof(struct cheader) +
            sizeof(struct cdesc) * cachebufs +
            nblksread * cachebufs * dev_bsize;
#ifdef STATS
        fprintf(stderr, "Using %d buffers (%d bytes)\n", cachebufs,
            sharedSize);
#endif

size_t is not an int on every platform, so you must not use the printf
sequence %d with a size_t variable without casting it to int.

>How-To-Repeat:

>Fix:

Use more reasonable types like unsigned long long or at least uint64_t.
>Release-Note:
>Audit-Trail:
>Unformatted: