⬢ DragonFlyBSD Kernel Audit
DF-2201 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c b/sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c
@@ -39,6 +39,8 @@
 ar5212GpioCfgOutput(struct ath_hal *ah, uint32_t gpio, HAL_GPIO_MUX_TYPE type)
 {
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	/*
 	 * NB: AR_GPIOCR_CR_A(pin) is all 1's so there's no need
@@ -57,6 +59,8 @@
 ar5212GpioCfgInput(struct ath_hal *ah, uint32_t gpio)
 {
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	OS_REG_WRITE(ah, AR_GPIOCR, 
 		  (OS_REG_READ(ah, AR_GPIOCR) &~ AR_GPIOCR_CR_A(gpio))
@@ -74,6 +78,8 @@
 	uint32_t reg;
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	reg =  OS_REG_READ(ah, AR_GPIODO);
 	reg &= ~(1 << gpio);
@@ -106,7 +112,8 @@
 {
 	uint32_t val;
 
-	/* XXX bounds check gpio */
+	if (gpio >= AR_NUM_GPIO)
+		return;
 	val = OS_REG_READ(ah, AR_GPIOCR);
 	val &= ~(AR_GPIOCR_CR_A(gpio) |
 		 AR_GPIOCR_INT_MASK | AR_GPIOCR_INT_ENA | AR_GPIOCR_INT_SEL);