4 files changed, 75 insertions, 0 deletions
diff --git a/share/security/patches/SA-16:38/bhyve-10.patch b/share/security/patches/SA-16:38/bhyve-10.patch
new file mode 100644
index 0000000000..aabab5315d
--- /dev/null
+++ b/share/security/patches/SA-16:38/bhyve-10.patch
@@ -0,0 +1,19 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -263,12 +263,14 @@
+ 	/* XXX VM_MMAP_SPARSE not implemented yet */
+ 	assert(ctx->vms == VM_MMAP_ALL);
+ 
+-	if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++	if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++	    gaddr + len <= ctx->lowmem)
+ 		return ((void *)(ctx->lowmem_addr + gaddr));
+ 
+ 	if (gaddr >= 4*GB) {
+ 		gaddr -= 4*GB;
+-		if (gaddr < ctx->highmem && gaddr + len <= ctx->highmem)
++		if (gaddr < ctx->highmem && len <= ctx->highmem &&
++		    gaddr + len <= ctx->highmem)
+ 			return ((void *)(ctx->highmem_addr + gaddr));
+ 	}
+ 
diff --git a/share/security/patches/SA-16:38/bhyve-10.patch.asc b/share/security/patches/SA-16:38/bhyve-10.patch.asc
new file mode 100644
index 0000000000..41e7ab4c63
--- /dev/null
+++ b/share/security/patches/SA-16:38/bhyve-10.patch.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIcBAABCgAGBQJYRw1wAAoJEO1n7NZdz2rnd+kP+wYnUY3tGokDR46N0MbjmkdY
+X8bedjtyUPzQdIW2gexICCLzMrxkN9a4yVEmOOHwTKmtoaFtjXNbn82T8ge1Pf10
+cX4qZg48WYOF4Ei188ZaD9xbnyabuBC5oxAMz4zkTVPlu5FuDI9kP1XyVvzA/8hA
+Q3d1106bxMrkJ/kvqyXy+tt8Rfmp5WG+D0D7zSQc4lREs+l5D49e5d1UFI0TrX1Y
+PTumDnzLZMfH6DO4rzMXRy+yohkGb8D5AW9IHbBVDaeLEeLnkzpHiiMcth3cg5LS
+2Nw+sDmAOaHJ4ea/B820T01mRpd3s8M1gfQz9bAoEd+wVuIBse2hBvaQMrXGJ5G3
+bsJtark4yi8rHg2mQ+z7hgkl1yJ/owIVVo0PvenuzFeRiKf93vxX8nFJvl2zdzDt
+hJWwzNTxg9zPsyWI4VnRqBQIw1ZUhNLwt1Y8buMwVUMv7n0nsqQ/tpKIG1KnFTl5
+no4agfA23+DksTPeZ/OuLTEq/lxRIzEdlAaSlSb6jp3RASHcGfYuf+A9+N2tyGT0
+4rhjvo9juHLsoqDXfMewKBLgyKJFfzMPDQ0Ykun7yrQKWoGG+9o1ZNvMVTMjQn9u
+ZdFMc5WHZAQPlYjB55ldTfeQ4ZX2yBaUTT+WREl2P4zsURM0DV6c7KbQB+XWQzIc
+cWECaLYiir4QRwA+atBZ
+=qWsA
+-----END PGP SIGNATURE-----
diff --git a/share/security/patches/SA-16:38/bhyve.patch b/share/security/patches/SA-16:38/bhyve.patch
new file mode 100644
index 0000000000..4ba3572c37
--- /dev/null
+++ b/share/security/patches/SA-16:38/bhyve.patch
@@ -0,0 +1,24 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -426,13 +426,18 @@
+ {
+ 
+ 	if (ctx->lowmem > 0) {
+-		if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++		if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++		    gaddr + len <= ctx->lowmem)
+ 			return (ctx->baseaddr + gaddr);
+ 	}
+ 
+ 	if (ctx->highmem > 0) {
+-		if (gaddr >= 4*GB && gaddr + len <= 4*GB + ctx->highmem)
+-			return (ctx->baseaddr + gaddr);
++                if (gaddr >= 4*GB) {
++			if (gaddr < 4*GB + ctx->highmem &&
++			    len <= ctx->highmem &&
++			    gaddr + len <= 4*GB + ctx->highmem)
++				return (ctx->baseaddr + gaddr);
++		}
+ 	}
+ 
+ 	return (NULL);
diff --git a/share/security/patches/SA-16:38/bhyve.patch.asc b/share/security/patches/SA-16:38/bhyve.patch.asc
new file mode 100644
index 0000000000..dac8d6ff2c
--- /dev/null
+++ b/share/security/patches/SA-16:38/bhyve.patch.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIcBAABCgAGBQJYRw1xAAoJEO1n7NZdz2rnBkgQAJWvZDz/GCdcuqp7jUfLvhKR
+/TZaPIe4v702RnoHEsR0pQqNx6wrXSswieiY8VIVE0IIyR6bMO1JgUE7HbSG2m/0
+uI6sgnlTmPKTpKipHmS+lHk/1Rr/bTIAUagyO5XFeq5LinHWdkvKpAgbk0WAFdR4
+0fzOMtyTyW+3+wRAKNG15aoZkscjU4gcEQzS1yVZWEoHQBHIV39sRteqr4/AT2vY
+3wiIjVuW5OwWFqRfX5vamwe/BK3ps07P+OaylnedyScgmI11csCbB6AOxDhlz5/r
+vkLzByMvSwZB7V4EEIvVMmTO57LRaUE5iJ7YNNFyh+4lVHbE+otetAgrf9KE4VIz
+d3DyGELIrAdxUNTx1A/Isog3MAMayxcItNu1kJZz93VxlWJVmrGFufwQigPwNQEd
+R+FeQNGDXYZBDSnl3k16ImL1QW0WLtQqCzSLE+y0Xna3HHUJcddunwLs5duDkaUT
+bHbPL8irN5FBY1WAPWmeusFO0GM1zaWjqYhVCyJLkv+H6aS+4nBIFF2hAmKXyzAc
++PK+rOl2G0HGs09ALKR8DgfzIbeGbB3mvknhUBmX527t6RrA3rWR4gZEwrvCYe4I
+q9lbvvPVoC/xJi3Lsa8xliuo1f7YazEgDNmzkzFjWJQinJKQn4ow3XSiXXqarUm2
+CSrOQJY+0UF23sJScppo
+=nJXA
+-----END PGP SIGNATURE-----