DragonFlyBSD Kernel Audit
DF-1436 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/sdhci/sdhci.c b/sys/dev/disk/sdhci/sdhci.c
--- a/sys/dev/disk/sdhci/sdhci.c
+++ b/sys/dev/disk/sdhci/sdhci.c
@@ -1734,6 +1734,8 @@
 	}
 	if (addr >= descmem->dmem_busaddr &&
 	    addr < descmem->dmem_busaddr + SDHCI_ADMA2_DESCBUF_SIZE) {
+		if ((addr - descmem->dmem_busaddr) + sizeof(*desc) > SDHCI_ADMA2_DESCBUF_SIZE)
+			return;
 		desc = (void *) ((char *)descmem->dmem_addr +
 		    (addr - descmem->dmem_busaddr));
 		slot_printf(slot,