Hurd: ioctl() incorrectly decodes argument

1 files changed, 12 insertions, 9 deletions

diff --git a/sysdeps/mach/hurd/ioctl.c b/sysdeps/mach/hurd/ioctl.c
index beffe4365e..543d437c1e 100644
--- a/sysdeps/mach/hurd/ioctl.c
+++ b/sysdeps/mach/hurd/ioctl.c
@@ -1,5 +1,4 @@
-/* Copyright (C) 1992,93,94,95,96,97,99,2000,2002,2005
-	Free Software Foundation, Inc.
+/* Copyright (C) 1992-2012 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -88,7 +87,7 @@ __ioctl (int fd, unsigned long int request, ...)
   void *p;
 #endif
 
-  void *arg;
+  void *arg = NULL;
 
   error_t err;
 
@@ -111,7 +110,7 @@ __ioctl (int fd, unsigned long int request, ...)
       if (_IOC_INOUT (request) & IOC_IN)
 	{
 	  /* We don't want to advance ARG since it will be used to copy out
-             too if IOC_OUT is also set.  */
+	     too if IOC_OUT is also set.  */
 	  void *argptr = arg;
 
 	  /* Pack an argument into the message buffer.  */
@@ -139,7 +138,7 @@ __ioctl (int fd, unsigned long int request, ...)
 	  in (_IOT_COUNT1 (type), _IOT_TYPE1 (type));
 	  in (_IOT_COUNT2 (type), _IOT_TYPE2 (type));
 	}
-      else if (_IOC_INOUT (request) == IOC_VOID)
+      else if (_IOC_INOUT (request) == IOC_VOID && _IOT_COUNT0 (type) != 0)
 	{
 	  /* The RPC takes a single integer_t argument.
 	     Rather than pointing to the value, ARG is the value itself.  */
@@ -208,11 +207,15 @@ __ioctl (int fd, unsigned long int request, ...)
       return msg.header.RetCode;
     }
 
-  va_list ap;
+  if (_IOT_COUNT0 (type) != 0)
+    {
+      /* Data need either be sent, received, or even both.  */
+      va_list ap;
 
-  va_start (ap, request);
-  arg = va_arg (ap, void *);
-  va_end (ap);
+      va_start (ap, request);
+      arg = va_arg (ap, void *);
+      va_end (ap);
+    }
 
   {
     /* Check for a registered handler for REQUEST.  */