From 7a351461e0a53d7f62468f9780306653bd43e99a Mon Sep 17 00:00:00 2001 From: nwhitehorn Date: Thu, 2 Sep 2010 22:26:49 +0000 Subject: In the case of non-sequential mappings, ofw_mapmem() could ask Open Firmware to map a memory region with negative length, causing crashes and Undefined Behavior. Add the appropriate check to make the behavior defined. --- sys/boot/ofw/libofw/ofw_copy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys/boot') diff --git a/sys/boot/ofw/libofw/ofw_copy.c b/sys/boot/ofw/libofw/ofw_copy.c index 93e7ec6..781d423 100644 --- a/sys/boot/ofw/libofw/ofw_copy.c +++ b/sys/boot/ofw/libofw/ofw_copy.c @@ -68,7 +68,7 @@ ofw_mapmem(vm_offset_t dest, const size_t len) /* * Trim area covered by existing mapping, if any */ - if (dest < (last_dest + last_len)) { + if (dest < (last_dest + last_len) && dest >= last_dest) { nlen -= (last_dest + last_len) - dest; dest = last_dest + last_len; } -- cgit v1.1