DragonFlyBSD Kernel Audit
DF-1606 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/acpica/acpi_hp/acpi_hp.c b/sys/dev/acpica/acpi_hp/acpi_hp.c
--- a/sys/dev/acpica/acpi_hp/acpi_hp.c
+++ b/sys/dev/acpica/acpi_hp/acpi_hp.c
@@ -1178,6 +1178,14 @@
 						instance = maxInstance;
 					}
 					else {
+						if (sc->cmi_order_size >=
+						    (int)nitems(sc->cmi_order)) {
+							device_printf(sc->dev,
+							    "CMI instance count exceeds "
+							    "%zu; truncating output\n",
+							    nitems(sc->cmi_order));
+							break;
+						}
 						pos = sc->cmi_order_size;
 						for (i=0;
 						  i<sc->cmi_order_size && i<127;