⬢ DragonFlyBSD Kernel Audit
DF-1090 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
diff --git a/sys/bus/isa/pnpparse.c b/sys/bus/isa/pnpparse.c
index 0000000..1111111 100644
--- a/sys/bus/isa/pnpparse.c
+++ b/sys/bus/isa/pnpparse.c
@@ -92,6 +92,8 @@
 			 * Got a compatible device id resource.
 			 * Should keep a list of compat ids in the device.
 			 */
+			if (len < 4)
+				break;
 			bcopy(res, &compat_id, 4);
 			if (isa_get_compatid(dev) == 0)
 				isa_set_compatid(dev, compat_id);
@@ -102,6 +104,8 @@
 				pnp_printf(id, "too many irqs\n");
 				return (1);
 			}
+			if (len < 2)
+				break;
 			if (I16(res) == 0) {
 				/* a null descriptor */
 				config->ic_irqmask[config->ic_nirq] = 0;
@@ -120,6 +124,8 @@
 				pnp_printf(id, "too many drqs\n");
 				return (1);
 			}
+			if (len < 1)
+				break;
 			if (res[0] == 0) {
 				/* a null descriptor */
 				config->ic_drqmask[config->ic_ndrq] = 0;
@@ -138,6 +144,8 @@
 				pnp_printf(id, "too many ports\n");
 				return (1);
 			}
+			if (len < 7)
+				break;
 			if (res[6] == 0) {
 				/* a null descriptor */
 				config->ic_port[config->ic_nport].ir_start = 0;
@@ -175,6 +183,8 @@
 				pnp_printf(id, "too many ports\n");
 				return (1);
 			}
+			if (len < 3)
+				break;
 			if (res[2] == 0) {
 				/* a null descriptor */
 				config->ic_port[config->ic_nport].ir_start = 0;
@@ -239,6 +249,8 @@
 				pnp_printf(id, "too many memory ranges\n");
 				return (1);
 			}
+			if (len < 9)
+				break;
 			if (I16(res + 7) == 0) {
 				/* a null descriptor */
 				config->ic_mem[config->ic_nmem].ir_start = 0;
@@ -275,6 +287,8 @@
 				pnp_printf(id, "too many memory ranges\n");
 				return (1);
 			}
+			if (len < 17)
+				break;
 			if (I32(res + 13) == 0) {
 				/* a null descriptor */
 				config->ic_mem[config->ic_nmem].ir_start = 0;
@@ -305,6 +319,8 @@
 				pnp_printf(id, "too many memory ranges\n");
 				return (1);
 			}
+			if (len < 9)
+				break;
 			if (I32(res + 5) == 0) {
 				/* a null descriptor */
 				config->ic_mem[config->ic_nmem].ir_start = 0;