diff options
| author | nwhitehorn <nwhitehorn@FreeBSD.org> | 2010-09-02 22:26:49 +0000 |
|---|---|---|
| committer | nwhitehorn <nwhitehorn@FreeBSD.org> | 2010-09-02 22:26:49 +0000 |
| commit | 7a351461e0a53d7f62468f9780306653bd43e99a (patch) | |
| tree | e532ff7c7f0cc5b834d62372b4c4ce7cdf09f34f /sys/boot/ofw | |
| parent | 6d44f4e25f889adb226c1c9e6cfeaf788b23528c (diff) | |
| download | FreeBSD-src-7a351461e0a53d7f62468f9780306653bd43e99a.zip FreeBSD-src-7a351461e0a53d7f62468f9780306653bd43e99a.tar.gz | |
In the case of non-sequential mappings, ofw_mapmem() could ask Open
Firmware to map a memory region with negative length, causing crashes
and Undefined Behavior. Add the appropriate check to make the behavior
defined.
Diffstat (limited to 'sys/boot/ofw')
| -rw-r--r-- | sys/boot/ofw/libofw/ofw_copy.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/boot/ofw/libofw/ofw_copy.c b/sys/boot/ofw/libofw/ofw_copy.c index 93e7ec6..781d423 100644 --- a/sys/boot/ofw/libofw/ofw_copy.c +++ b/sys/boot/ofw/libofw/ofw_copy.c @@ -68,7 +68,7 @@ ofw_mapmem(vm_offset_t dest, const size_t len) /* * Trim area covered by existing mapping, if any */ - if (dest < (last_dest + last_len)) { + if (dest < (last_dest + last_len) && dest >= last_dest) { nlen -= (last_dest + last_len) - dest; dest = last_dest + last_len; } |
