d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In openprom_ioctl() ensure appropriate permissions and that data isn't

Browse Source 
NULL and doesn't point to a NULL pointer before dereferencing it. This
fixes a panic triggered by Xorg 7.3.

Reported and tested by:	Bill Green
MFC after:		3 days
This commit is contained in:
Marius Strobl 2007-12-20 00:31:04 +00:00
parent 58c9a67ed7
commit 75d63045d9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=174802
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/dev/ofw/openpromio.c
View File

@ -101,12 +101,17 @@ openprom_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
char *buf;
int error;
if ((flags & FREAD) == 0)
return (EPERM);
prop = buf = NULL;
error = 0;
oprom = *(void **)data;
switch (cmd) {
case OPROMCHILD:
case OPROMNEXT:
if (data == NULL || *(void **)data == NULL)
return (EINVAL);
oprom = *(void **)data;
error = copyin(&oprom->oprom_size, &len, sizeof(len));
if (error != 0)
break;
@ -135,6 +140,9 @@ openprom_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
break;
case OPROMGETPROP:
case OPROMNXTPROP:
if (data == NULL || *(void **)data == NULL)
return (EINVAL);
oprom = *(void **)data;
error = copyin(&oprom->oprom_size, &len, sizeof(len));
if (error != 0)
break;