d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix off by one error in mbuf access. Previously it caused panic.

Browse Source 
While I'm here use NULL to compare mbuf pointer and add additional
check for zero length mbuf before accessing the mbuf.

PR:	kern/162932
This commit is contained in:
Pyun YongHyeon 2011-12-05 18:10:43 +00:00
parent 782ed6d3d7
commit e9d7727e6b
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
sys/dev/ed/if_ed.c
View File

@ -1709,12 +1709,19 @@ ed_shmem_write_mbufs(struct ed_softc *sc, struct mbuf *m, bus_size_t dst)
break;
}
}
for (len = 0; m != 0; m = m->m_next) {
if (sc->isa16bit)
bus_space_write_region_2(sc->mem_bst,
sc->mem_bsh, dst,
mtod(m, uint16_t *), (m->m_len + 1)/ 2);
else
for (len = 0; m != NULL; m = m->m_next) {
if (m->m_len == 0)
continue;
if (sc->isa16bit) {
if (m->m_len > 1)
bus_space_write_region_2(sc->mem_bst,
sc->mem_bsh, dst,
mtod(m, uint16_t *), m->m_len / 2);
if ((m->m_len & 1) != 0)
bus_space_write_1(sc->mem_bst, sc->mem_bsh,
dst + m->m_len - 1,
*(mtod(m, uint8_t *) + m->m_len - 1));
} else
bus_space_write_region_1(sc->mem_bst,
sc->mem_bsh, dst,
mtod(m, uint8_t *), m->m_len);