diff options
| author | kib <kib@FreeBSD.org> | 2016-05-20 19:50:32 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2016-05-20 19:50:32 +0000 |
| commit | 515614230c7fbf67f7b6d03a667d2b4d062db2e4 (patch) | |
| tree | bb53d495bd6c8777185aeb035abd61d58782fe9b /sys/amd64 | |
| parent | ed372eaa9f032280d69d640f9d5246be48d4fb25 (diff) | |
| download | FreeBSD-src-515614230c7fbf67f7b6d03a667d2b4d062db2e4.zip FreeBSD-src-515614230c7fbf67f7b6d03a667d2b4d062db2e4.tar.gz | |
Check for overflow and return EINVAL if detected. Backport this and
r300305 to i386.
PR: 209661
Reported and reviewed by: cturt
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Diffstat (limited to 'sys/amd64')
| -rw-r--r-- | sys/amd64/amd64/sys_machdep.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index 7a1df6b..4f85e1f 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -344,7 +344,8 @@ amd64_set_ioperm(td, uap) return (error); if ((error = securelevel_gt(td->td_ucred, 0)) != 0) return (error); - if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) + if (uap->start > uap->start + uap->length || + uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) return (EINVAL); /* |
