diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2023-08-28 03:38:30 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2023-08-28 19:37:09 +0000 |
| commit | b5a5a06fc012d27c6937776bff8469ea465c3873 (patch) | |
| tree | 329f47ac873186946bca0761aac77d7c44d33904 | |
| parent | 89437732d361d9b761660021cefc3f362c9ca672 (diff) | |
| download | src-b5a5a06fc012d27c6937776bff8469ea465c3873.tar.gz src-b5a5a06fc012d27c6937776bff8469ea465c3873.zip | |
iir: prevent negative offsets in ioctl
Direct commit to stable/13 as this driver has been removed from main in
commit 399188a2c60c ("iir: Remove").
PR: 273328
Reported by: ChenHao Lu
Sponsored by: The FreeBSD Foundation
| -rw-r--r-- | sys/dev/iir/iir.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/iir/iir.c b/sys/dev/iir/iir.c index d030227c6dd6..15c8db856d0e 100644 --- a/sys/dev/iir/iir.c +++ b/sys/dev/iir/iir.c @@ -1853,7 +1853,7 @@ int gdt_read_event(int handle, gdt_evt_str *estr) eindex = handle; estr->event_source = 0; - if (eindex >= GDT_MAX_EVENTS) { + if (eindex < 0 || eindex >= GDT_MAX_EVENTS) { mtx_unlock(&elock); return eindex; } |