diff options
| author | tijl <tijl@FreeBSD.org> | 2014-10-30 14:36:27 +0000 |
|---|---|---|
| committer | tijl <tijl@FreeBSD.org> | 2014-10-30 14:36:27 +0000 |
| commit | 5246b4d3f358eaea830cccd1c8695c8f66cc0499 (patch) | |
| tree | d176b5b1018482f9d5efd262e11652bba809d3ee /sys/dev/agp | |
| parent | d208d96586773ea873541701bafa3c45292fd2e6 (diff) | |
| download | FreeBSD-src-5246b4d3f358eaea830cccd1c8695c8f66cc0499.zip FreeBSD-src-5246b4d3f358eaea830cccd1c8695c8f66cc0499.tar.gz | |
Avoid possible overflow in agp_generic_alloc_memory.
MFC after: 1 week
Diffstat (limited to 'sys/dev/agp')
| -rw-r--r-- | sys/dev/agp/agp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/agp/agp.c b/sys/dev/agp/agp.c index 37dd486..d0cebb0 100644 --- a/sys/dev/agp/agp.c +++ b/sys/dev/agp/agp.c @@ -485,7 +485,7 @@ agp_generic_alloc_memory(device_t dev, int type, vm_size_t size) if ((size & (AGP_PAGE_SIZE - 1)) != 0) return 0; - if (sc->as_allocated + size > sc->as_maxmem) + if (size > sc->as_maxmem - sc->as_allocated) return 0; if (type != 0) { |
