⬢ DragonFlyBSD Kernel Audit
DF-3723 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/ix/ixgbe_x550.c
+++ b/sys/dev/netif/ix/ixgbe_x550.c
@@ -3355,7 +3355,7 @@
 		}
 		local_buffer = buf;
 	} else {
-		if (buffer_size < ptr)
+		if (buffer_size <= ptr)
 			return  IXGBE_ERR_PARAM;
 		local_buffer = &buffer[ptr];
 	}
@@ -3373,7 +3373,7 @@
 			return IXGBE_SUCCESS;
 	}
 
-	if (buffer && ((u32)start + (u32)length > buffer_size))
+	if (buffer && ((u32)ptr + (u32)start + (u32)length > buffer_size))
 		return IXGBE_ERR_PARAM;
 
 	for (i = start; length; i++, length--) {
@@ -3427,7 +3427,7 @@
 		}
 		local_buffer = eeprom_ptrs;
 	} else {
-		if (buffer_size < IXGBE_EEPROM_LAST_WORD)
+		if (buffer_size < IXGBE_EEPROM_LAST_WORD + 1)
 			return IXGBE_ERR_PARAM;
 		local_buffer = buffer;
 	}