DragonFlyBSD Kernel Audit
DF-1569 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/video/bktr/bktr_card.c b/sys/dev/video/bktr/bktr_card.c
--- a/sys/dev/video/bktr/bktr_card.c
+++ b/sys/dev/video/bktr/bktr_card.c
@@ -998,12 +998,15 @@
 		unsigned char tuner_code;
 		unsigned char no_audio_mux;
 
-		readEEProm(bktr, 0, 128, (u_char *) &eeprom );
+		if ( readEEProm(bktr, 0, 128, (u_char *) &eeprom ) < 0 )
+			break;
 
 		/* LOCATE THE EEPROM DATA BLOCKS */
 		block_1 = &eeprom[0];
 		block_1_data_size = (block_1[2] << 8 | block_1[1]);
-		block_1_total_size = block_1_data_size + 3; /* Header bytes */   
+		block_1_total_size = block_1_data_size + 3; /* Header bytes */
+		if (block_1_total_size > 128 - 3)
+			break;   
     
 		block_2 = &eeprom[block_1_total_size];
 		block_2_data_size = (block_2[2] << 8 | block_2[1]);