--- xnu/xnu-1228/libkern/c++/OSData.cpp
+++ xnu/xnu-4903.231.4/libkern/c++/OSData.cpp
@@ -29,16 +29,20 @@
 
 #include <string.h>
 
+__BEGIN_DECLS
+#include <vm/vm_kern.h>
+__END_DECLS
+
 #include <libkern/c++/OSData.h>
 #include <libkern/c++/OSSerialize.h>
 #include <libkern/c++/OSLib.h>
 #include <libkern/c++/OSString.h>
-#include <string.h>
+#include <IOKit/IOLib.h>
 
 #define super OSObject
 
 OSDefineMetaClassAndStructors(OSData, OSObject)
-OSMetaClassDefineReservedUnused(OSData, 0);
+OSMetaClassDefineReservedUsed(OSData, 0);    // setDeallocFunction
 OSMetaClassDefineReservedUnused(OSData, 1);
 OSMetaClassDefineReservedUnused(OSData, 2);
 OSMetaClassDefineReservedUnused(OSData, 3);
@@ -49,32 +53,38 @@
 
 #define EXTERNAL ((unsigned int) -1)
 
-#if OSALLOCDEBUG
-extern int debug_container_malloc_size;
-#define ACCUMSIZE(s) do { debug_container_malloc_size += (s); } while(0)
-#else
-#define ACCUMSIZE(s)
-#endif
-
 bool OSData::initWithCapacity(unsigned int inCapacity)
 {
+    if (data)
+    {
+        OSCONTAINER_ACCUMSIZE(-((size_t)capacity));
+	if (!inCapacity || (capacity < inCapacity))
+	{
+	    // clean out old data's storage if it isn't big enough
+	    if (capacity < page_size) kfree(data, capacity);
+	    else                      kmem_free(kernel_map, (vm_offset_t)data, capacity);
+	    data = 0;
+	    capacity = 0;
+	}
+    }
+
     if (!super::init())
         return false;
 
-    if (data && (!inCapacity || capacity < inCapacity) ) {
-        // clean out old data's storage if it isn't big enough
-        kfree(data, capacity);
-        data = 0;
-        ACCUMSIZE(-capacity);
-    }
-
     if (inCapacity && !data) {
-        data = (void *) kalloc(inCapacity);
+
+	if (inCapacity < page_size) data = (void *) kalloc_container(inCapacity);
+	else {
+	    kern_return_t kr;
+	    if (round_page_overflow(inCapacity, &inCapacity)) kr = KERN_RESOURCE_SHORTAGE;
+	    else kr = kmem_alloc(kernel_map, (vm_offset_t *)&data, inCapacity, IOMemoryTag(kernel_map));
+	    if (KERN_SUCCESS != kr) data = NULL;
+	}
         if (!data)
             return false;
         capacity = inCapacity;
-        ACCUMSIZE(inCapacity);
-    }
+    }
+    OSCONTAINER_ACCUMSIZE(capacity);
 
     length = 0;
     if (inCapacity < 16)
@@ -187,10 +197,17 @@
 
 void OSData::free()
 {
-    if (capacity != EXTERNAL && data && capacity) {
-        kfree(data, capacity);
-        ACCUMSIZE( -capacity );
-    }
+    if ((capacity != EXTERNAL) && data && capacity) {
+	if (capacity < page_size) kfree(data, capacity);
+	else                      kmem_free(kernel_map, (vm_offset_t)data, capacity);
+        OSCONTAINER_ACCUMSIZE( -((size_t)capacity) );
+    } else if (capacity == EXTERNAL) {
+	DeallocFunction freemem = reserved ? reserved->deallocFunction : NULL;
+	if (freemem && data && length) {
+		freemem(data, length);
+	}
+    }
+    if (reserved) kfree(reserved, sizeof(ExpansionData));
     super::free();
 }
 
@@ -207,27 +224,56 @@
     return capacityIncrement = increment; 
 }
 
+// xx-review: does not check for capacity == EXTERNAL
+
 unsigned int OSData::ensureCapacity(unsigned int newCapacity)
 {
     unsigned char * newData;
+    unsigned int finalCapacity;
+    void * copydata;
+    kern_return_t kr;
 
     if (newCapacity <= capacity)
         return capacity;
 
-    newCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
+    finalCapacity = (((newCapacity - 1) / capacityIncrement) + 1)
                 * capacityIncrement;
 
-    newData = (unsigned char *) kalloc(newCapacity);
-    
+    // integer overflow check
+    if (finalCapacity < newCapacity) return capacity;
+
+    copydata = data;
+
+    if (finalCapacity >= page_size) {
+	// round up
+	finalCapacity = round_page_32(finalCapacity);
+	// integer overflow check
+	if (finalCapacity < newCapacity) return capacity;
+	if (capacity >= page_size) {
+	    copydata = NULL;
+	    kr = kmem_realloc(kernel_map,
+			      (vm_offset_t)data,
+			      capacity,
+			      (vm_offset_t *)&newData,
+			      finalCapacity,
+			      IOMemoryTag(kernel_map));
+	} else {
+	    kr = kmem_alloc(kernel_map, (vm_offset_t *)&newData, finalCapacity, IOMemoryTag(kernel_map));
+	}
+	if (KERN_SUCCESS != kr) newData = NULL;
+    }
+    else newData = (unsigned char *) kalloc_container(finalCapacity);
+
     if ( newData ) {
-        bzero(newData + capacity, newCapacity - capacity);
+        bzero(newData + capacity, finalCapacity - capacity);
+        if (copydata) bcopy(copydata, newData, capacity);
         if (data) {
-            bcopy(data, newData, capacity);
-            kfree(data, capacity);
+	    if (capacity < page_size) kfree(data, capacity);
+	    else                      kmem_free(kernel_map, (vm_offset_t)data, capacity);
         }
-        ACCUMSIZE( newCapacity - capacity );
+        OSCONTAINER_ACCUMSIZE( ((size_t)finalCapacity) - ((size_t)capacity) );
         data = (void *) newData;
-        capacity = newCapacity;
+        capacity = finalCapacity;
     }
 
     return capacity;
@@ -243,7 +289,9 @@
     if (capacity == EXTERNAL)
         return false;
     
-    newSize = length + inLength;
+    if (os_add_overflow(length, inLength, &newSize))
+        return false;
+
     if ( (newSize > capacity) && newSize > ensureCapacity(newSize) )
         return false;
 
@@ -267,7 +315,9 @@
     if (capacity == EXTERNAL)
         return false;
     
-    newSize = length + inLength;
+    if (os_add_overflow(length, inLength, &newSize))
+        return false;
+
     if ( (newSize > capacity) && newSize > ensureCapacity(newSize) )
         return false;
 
@@ -297,6 +347,7 @@
 
     if (length
     &&  start < length
+    && (start + inLength) >= inLength // overflow check
     && (start + inLength) <= length)
         outData = (const void *) ((char *) data + start);
 
@@ -321,11 +372,11 @@
 
 bool OSData::isEqualTo(const OSMetaClassBase *obj) const
 {
-    OSData *	data;
+    OSData *	otherData;
     OSString *  str;
 
-    if ((data = OSDynamicCast(OSData, obj)))
-        return isEqualTo(data);
+    if ((otherData = OSDynamicCast(OSData, obj)))
+        return isEqualTo(otherData);
     else if ((str = OSDynamicCast (OSString, obj)))
         return isEqualTo(str);
     else
@@ -381,12 +432,16 @@
     unsigned int i;
     const unsigned char *p;
     unsigned char c;
+    unsigned int serializeLength;
 
     if (s->previouslySerialized(this)) return true;
 
     if (!s->addXMLStartTag(this, "data")) return false;
 
-    for (i = 0, p = (unsigned char *)data; i < length; i++, p++) {
+    serializeLength = length;
+    if (reserved && reserved->disableSerialization) serializeLength = 0;
+
+    for (i = 0, p = (unsigned char *)data; i < serializeLength; i++, p++) {
         /* 3 bytes are encoded as 4 */
         switch (i % 3) {
 	case 0:
@@ -423,3 +478,30 @@
 
     return s->addXMLEndTag("data");
 }
+
+void OSData::setDeallocFunction(DeallocFunction func)
+{
+    if (!reserved)
+    {
+    	reserved = (typeof(reserved)) kalloc_container(sizeof(ExpansionData));
+        if (!reserved) return;
+        bzero(reserved, sizeof(ExpansionData));
+    }
+    reserved->deallocFunction = func;
+}
+
+void OSData::setSerializable(bool serializable)
+{
+    if (!reserved)
+    {
+    	reserved = (typeof(reserved)) kalloc_container(sizeof(ExpansionData));
+	if (!reserved) return;
+	bzero(reserved, sizeof(ExpansionData));
+    }
+    reserved->disableSerialization = (!serializable);
+}
+
+bool OSData::isSerializable(void)
+{
+    return (!reserved || !reserved->disableSerialization);
+}