DragonFlyBSD Kernel Audit
DF-1060 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/bus/firewire/fwdev.c b/sys/bus/firewire/fwdev.c
--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -655,8 +655,13 @@
 		fwdevlst->info_len = len;
 		break;
 	case FW_GTPMAP:
-		bcopy(sc->fc->topology_map, ap->a_data,
-				(sc->fc->topology_map->crc_len + 1) * 4);
+		{
+			u_int cl = sc->fc->topology_map->crc_len;
+			u_int maxcl = sizeof(struct fw_topology_map) / 4 - 1;
+			if (cl > maxcl)
+				cl = maxcl;
+			bcopy(sc->fc->topology_map, ap->a_data, (cl + 1) * 4);
+		}
 		break;
 	case FW_GCROM:
 		STAILQ_FOREACH(fwdev, &sc->fc->devices, link)