⬢ DragonFlyBSD Kernel Audit
DF-2385 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- a/sys/dev/acpica/acpi_package.c
+++ b/sys/dev/acpica/acpi_package.c
@@ -73,6 +73,8 @@
     void		*ptr;
     size_t		 length;
 
+    if (res == NULL || idx < 0 || idx >= res->Package.Count)
+	return (EINVAL);
     obj = &res->Package.Elements[idx];
     if (obj == NULL)
 	return (EINVAL);
@@ -106,6 +108,8 @@
     ACPI_GENERIC_ADDRESS gas;
     ACPI_OBJECT *obj;
 
+    if (res == NULL || idx < 0 || idx >= res->Package.Count)
+	return (EINVAL);
     obj = &res->Package.Elements[idx];
     if (obj == NULL || obj->Type != ACPI_TYPE_BUFFER ||
 	obj->Buffer.Length < sizeof(ACPI_GENERIC_ADDRESS) + 3)
@@ -120,6 +124,9 @@
 acpi_PkgRawGas(ACPI_OBJECT *res, int idx, ACPI_GENERIC_ADDRESS *gas)
 {
     ACPI_OBJECT         *obj;
+
+    if (res == NULL || idx < 0 || idx >= res->Package.Count)
+	return (EINVAL);
     obj = &res->Package.Elements[idx];
     if (obj == NULL || obj->Type != ACPI_TYPE_BUFFER ||
         obj->Buffer.Length < sizeof(ACPI_GENERIC_ADDRESS) + 3)