--- xnu/xnu-1228.3.13/libkern/c++/OSOrderedSet.cpp
+++ xnu/xnu-3789.31.2/libkern/c++/OSOrderedSet.cpp
@@ -42,14 +42,6 @@
 OSMetaClassDefineReservedUnused(OSOrderedSet, 6);
 OSMetaClassDefineReservedUnused(OSOrderedSet, 7);
 
-#if OSALLOCDEBUG
-extern "C" {
-    extern int debug_container_malloc_size;
-};
-#define ACCUMSIZE(s) do { debug_container_malloc_size += (s); } while(0)
-#else
-#define ACCUMSIZE(s)
-#endif
 
 struct _Element {
     const OSMetaClassBase *		obj;
@@ -63,13 +55,16 @@
 initWithCapacity(unsigned int inCapacity,
                  OSOrderFunction inOrdering, void *inOrderingRef)
 {
-    int size;
+    unsigned int size;
 
     if (!super::init())
         return false;
 
+    if (inCapacity > (UINT_MAX / sizeof(_Element)))
+        return false;
+
     size = sizeof(_Element) * inCapacity;
-    array = (_Element *) kalloc(size);
+    array = (_Element *) kalloc_container(size);
     if (!array)
         return false;
 
@@ -80,9 +75,9 @@
     orderingRef = inOrderingRef;
 
     bzero(array, size);
-    ACCUMSIZE(size);
-
-    return this;	
+    OSCONTAINER_ACCUMSIZE(size);
+
+    return true;	
 }
 
 OSOrderedSet * OSOrderedSet::
@@ -106,7 +101,7 @@
 
     if (array) {
         kfree(array, sizeof(_Element) * capacity);
-        ACCUMSIZE( -(sizeof(_Element) * capacity) );
+        OSCONTAINER_ACCUMSIZE( -(sizeof(_Element) * capacity) );
     }
 
     super::free();
@@ -125,27 +120,35 @@
 unsigned int OSOrderedSet::ensureCapacity(unsigned int newCapacity)
 {
     _Element *newArray;
-    int oldSize, newSize;
+    unsigned int finalCapacity;
+    vm_size_t    oldSize, newSize;
 
     if (newCapacity <= capacity)
         return capacity;
 
     // round up
-    newCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
+    finalCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
                 * capacityIncrement;
-    newSize = sizeof(_Element) * newCapacity;
-
-    newArray = (_Element *) kalloc(newSize);
+    if ((finalCapacity < newCapacity) ||
+        (finalCapacity > (UINT_MAX / sizeof(_Element)))) {
+        return capacity;
+    }
+    newSize = sizeof(_Element) * finalCapacity;
+
+    newArray = (_Element *) kallocp_container(&newSize);
     if (newArray) {
+        // use all of the actual allocation size
+        finalCapacity = newSize / sizeof(_Element);
+
         oldSize = sizeof(_Element) * capacity;
 
-        ACCUMSIZE(newSize - oldSize);
+        OSCONTAINER_ACCUMSIZE(((size_t)newSize) - ((size_t)oldSize));
 
         bcopy(array, newArray, oldSize);
         bzero(&newArray[capacity], newSize - oldSize);
         kfree(array, oldSize);
         array = newArray;
-        capacity = newCapacity;
+        capacity = finalCapacity;
     }
 
     return capacity;
@@ -205,7 +208,7 @@
 
 
 #define ORDER(obj1,obj2) \
-    (ordering ? ((*ordering)( (OSObject *) obj1, (OSObject *) obj2, orderingRef)) : 0)
+    (ordering ? ((*ordering)( (const OSObject *) obj1, (const OSObject *) obj2, orderingRef)) : 0)
 
 bool OSOrderedSet::setObject(const OSMetaClassBase *anObject )
 {
@@ -226,9 +229,9 @@
 
     for (i = 0; i < count; i++) {
 
-        if( deleted)
+        if (deleted)
             array[i-1] = array[i];
-        else if( (array[i].obj == anObject)) {
+        else if (array[i].obj == anObject) {
             deleted = true;
 	    haveUpdated();	// Pity we can't flush the log
             array[i].obj->taggedRelease(OSTypeID(OSCollection));
@@ -264,13 +267,13 @@
 //    if( pri)
 //	*pri = array[index].pri;
 
-    return( (OSObject *) array[index].obj );
+    return( const_cast<OSObject *>((const OSObject *) array[index].obj) );
 }
 
 OSObject *OSOrderedSet::getFirstObject() const
 {
     if( count)
-        return( (OSObject *) array[0].obj );
+        return( const_cast<OSObject *>((const OSObject *) array[0].obj) );
     else
 	return( 0 );
 }
@@ -278,7 +281,7 @@
 OSObject *OSOrderedSet::getLastObject() const
 {
     if( count)
-        return( (OSObject *) array[count-1].obj );
+        return( const_cast<OSObject *>((const OSObject *) array[count-1].obj) );
     else
 	return( 0 );
 }
@@ -342,7 +345,7 @@
     unsigned int index = (*iteratorP)++;
 
     if (index < count)
-        *ret = (OSObject *) array[index].obj;
+        *ret = const_cast<OSObject *>((const OSObject *) array[index].obj);
     else
         *ret = 0;