Sanity check ptr for legal values so it is less likely

(but not impossible) to get stuck in an infinite loop.

Obtained from:	msmith@freebsd.org

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/dev/pci/pci.c b/sys/dev/pci/pci.c
index deb9428..523c21d 100644
--- a/sys/dev/pci/pci.c
+++ b/sys/dev/pci/pci.c
@@ -379,6 +379,12 @@ pci_read_extcap(device_t pcib, pcicfgregs *cfg)
 	 * Read capability entries.
 	 */
 	while (nextptr != 0) {
+		/* Sanity check */
+		if (nextptr > 255) {
+			printf("illegal PCI extended capability offset %d\n",
+			    nextptr);
+			return;
+		}
 		/* Find the next entry */
 		ptr = nextptr;
 		nextptr = REG(ptr + 1, 1);