DF-1569 / fix.diff
diff --git a/sys/dev/video/bktr/bktr_card.c b/sys/dev/video/bktr/bktr_card.c --- a/sys/dev/video/bktr/bktr_card.c +++ b/sys/dev/video/bktr/bktr_card.c @@ -998,12 +998,15 @@ unsigned char tuner_code; unsigned char no_audio_mux; - readEEProm(bktr, 0, 128, (u_char *) &eeprom ); + if ( readEEProm(bktr, 0, 128, (u_char *) &eeprom ) < 0 ) + break; /* LOCATE THE EEPROM DATA BLOCKS */ block_1 = &eeprom[0]; block_1_data_size = (block_1[2] << 8 | block_1[1]); - block_1_total_size = block_1_data_size + 3; /* Header bytes */ + block_1_total_size = block_1_data_size + 3; /* Header bytes */ + if (block_1_total_size > 128 - 3) + break; block_2 = &eeprom[block_1_total_size]; block_2_data_size = (block_2[2] << 8 | block_2[1]); |