diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2016-05-20 19:50:32 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2016-05-20 19:50:32 +0000 |
| commit | 0bfad8e4a3e8123060ac6265d85e74a7021f459b (patch) | |
| tree | bb53d495bd6c8777185aeb035abd61d58782fe9b /sys/i386/i386/sys_machdep.c | |
| parent | f0ec174043a8480b62deaf1268c0ca12ebd86f85 (diff) | |
| download | src-0bfad8e4a3e8123060ac6265d85e74a7021f459b.tar.gz src-0bfad8e4a3e8123060ac6265d85e74a7021f459b.zip | |
Check for overflow and return EINVAL if detected. Backport this and
r300305 to i386.
PR: 209661
Reported and reviewed by: cturt
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=300332
Diffstat (limited to 'sys/i386/i386/sys_machdep.c')
| -rw-r--r-- | sys/i386/i386/sys_machdep.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c index 4f78e2994e0c..9c8d94b44b81 100644 --- a/sys/i386/i386/sys_machdep.c +++ b/sys/i386/i386/sys_machdep.c @@ -315,8 +315,9 @@ i386_set_ioperm(td, uap) struct thread *td; struct i386_ioperm_args *uap; { - int i, error; char *iomap; + u_int i; + int error; if ((error = priv_check(td, PRIV_IO)) != 0) return (error); @@ -334,7 +335,8 @@ i386_set_ioperm(td, uap) return (error); iomap = (char *)td->td_pcb->pcb_ext->ext_iomap; - if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) + if (uap->start > uap->start + uap->length || + uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) return (EINVAL); for (i = uap->start; i < uap->start + uap->length; i++) { |