⬢ DragonFlyBSD Kernel Audit
DF-2199 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c b/sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c
--- a/sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c
+++ b/sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c
@@ -40,6 +40,8 @@
 	uint32_t gpioOffset = (AR5312_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	OS_REG_WRITE(ah, gpioOffset+AR5312_GPIOCR,
 		  (OS_REG_READ(ah, gpioOffset+AR5312_GPIOCR) &~ AR_GPIOCR_CR_A(gpio))
@@ -57,6 +59,8 @@
 	uint32_t gpioOffset = (AR5312_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	OS_REG_WRITE(ah, gpioOffset+AR5312_GPIOCR,
 		  (OS_REG_READ(ah, gpioOffset+AR5312_GPIOCR) &~ AR_GPIOCR_CR_A(gpio))
@@ -75,6 +79,8 @@
         uint32_t gpioOffset = (AR5312_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	reg =  OS_REG_READ(ah, gpioOffset+AR5312_GPIODO);
 	reg &= ~(1 << gpio);
@@ -110,7 +116,8 @@
 	uint32_t val;
         uint32_t gpioOffset = (AR5312_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
-	/* XXX bounds check gpio */
+	if (gpio >= AR_NUM_GPIO)
+		return;
 	val = OS_REG_READ(ah, gpioOffset+AR5312_GPIOCR);
 	val &= ~(AR_GPIOCR_CR_A(gpio) |
 		 AR_GPIOCR_INT_MASK | AR_GPIOCR_INT_ENA | AR_GPIOCR_INT_SEL);