d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check for overflow and return EINVAL if detected. Backport this and

Browse Source 
r300305 to i386.

PR:	209661
Reported and reviewed by:	cturt
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
This commit is contained in:
Konstantin Belousov 2016-05-20 19:50:32 +00:00
parent f0ec174043
commit 0bfad8e4a3
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/amd64/amd64/sys_machdep.c
View File

@ -344,7 +344,8 @@ amd64_set_ioperm(td, uap)
return (error);
if ((error = securelevel_gt(td->td_ucred, 0)) != 0)
return (error);
if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY)
if (uap->start > uap->start + uap->length ||
uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY)
return (EINVAL);
/*

6
sys/i386/i386/sys_machdep.c
View File

@ -315,8 +315,9 @@ i386_set_ioperm(td, uap)
struct thread *td;
struct i386_ioperm_args *uap;
{
int i, error;
char *iomap;
u_int i;
int error;
if ((error = priv_check(td, PRIV_IO)) != 0)
return (error);
@ -334,7 +335,8 @@ i386_set_ioperm(td, uap)
return (error);
iomap = (char *)td->td_pcb->pcb_ext->ext_iomap;
if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY)
if (uap->start > uap->start + uap->length ||
uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY)
return (EINVAL);
for (i = uap->start; i < uap->start + uap->length; i++) {