diff options
| author | peter <peter@FreeBSD.org> | 2002-09-28 19:37:54 +0000 |
|---|---|---|
| committer | peter <peter@FreeBSD.org> | 2002-09-28 19:37:54 +0000 |
| commit | a88841129cf9273977da53043ddbeb1de0786d01 (patch) | |
| tree | df930f77c887f163a8c5fc2910d4e62148053085 /sys/amd64 | |
| parent | 71cf537fe718b78e8591d77f0933ff688b2ad62c (diff) | |
| download | FreeBSD-src-a88841129cf9273977da53043ddbeb1de0786d01.zip FreeBSD-src-a88841129cf9273977da53043ddbeb1de0786d01.tar.gz | |
Repair range checking for reading the ldt list.
PR: 38016
Submitted by: davidx
Diffstat (limited to 'sys/amd64')
| -rw-r--r-- | sys/amd64/amd64/sys_machdep.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index c756be7..3e3a4c4 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -389,7 +389,7 @@ i386_get_ldt(td, args) num = min(uap->num, nldt); lp = &ldt[uap->start]; } - if (uap->start > nldt) + if (uap->start + num > nldt) return(EINVAL); error = copyout(lp, uap->descs, num * sizeof(union descriptor)); |
