⬢ DragonFlyBSD Kernel Audit
DF-2288 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
diff --git a/sys/bus/firewire/firewire.c b/sys/bus/firewire/firewire.c
--- a/sys/bus/firewire/firewire.c
+++ b/sys/bus/firewire/firewire.c
@@ -1497,6 +1497,9 @@
 			fc->ongodev->status = FWDEVATTACHED;
 			goto nextnode;
 		}
+		if ((fc->ongoaddr - CSRROMOFF) >= CSRROMSIZE) {
+			goto nextnode;
+		}
 		fc->ongodev->csrrom[(fc->ongoaddr - CSRROMOFF)/4] = ntohl(rfp->mode.rresq.data);
 		if(fc->ongoaddr > fc->ongodev->rommax){
 			fc->ongodev->rommax = fc->ongoaddr;
@@ -1517,6 +1520,10 @@
 					goto nextnode;
 				}else{
 					csrd->ongoaddr = fc->ongoaddr;
+					if (csrreg->val > (CSRROMSIZE / 4) ||
+					    fc->ongoaddr > CSRROMOFF + CSRROMSIZE - csrreg->val * 4) {
+						goto nextnode;
+					}
 					fc->ongoaddr += csrreg->val * 4;
 					csrd->off = fc->ongoaddr;
 					SLIST_REMOVE_HEAD(&fc->csrfree, link);
@@ -1555,7 +1562,7 @@
 				offset = csrd->off;
 			}
 		}
-		if((fc->ongoaddr - CSRROMOFF) > CSRROMSIZE){
+		if((fc->ongoaddr - CSRROMOFF) >= CSRROMSIZE){
 			goto nextnode;
 		}
 	}