d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In the case of non-sequential mappings, ofw_mapmem() could ask Open

Browse Source 
Firmware to map a memory region with negative length, causing crashes
and Undefined Behavior. Add the appropriate check to make the behavior
defined.
This commit is contained in:
Nathan Whitehorn 2010-09-02 22:26:49 +00:00
parent 287cf3e528
commit fa942e6074
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=212165
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/boot/ofw/libofw/ofw_copy.c
View File

@ -68,7 +68,7 @@ ofw_mapmem(vm_offset_t dest, const size_t len)
/*
* Trim area covered by existing mapping, if any
*/
if (dest < (last_dest + last_len)) {
if (dest < (last_dest + last_len) && dest >= last_dest) {
nlen -= (last_dest + last_len) - dest;
dest = last_dest + last_len;
}