DF-3723 / fix.diff
--- a/sys/dev/netif/ix/ixgbe_x550.c +++ b/sys/dev/netif/ix/ixgbe_x550.c @@ -3355,7 +3355,7 @@ } local_buffer = buf; } else { - if (buffer_size < ptr) + if (buffer_size <= ptr) return IXGBE_ERR_PARAM; local_buffer = &buffer[ptr]; } @@ -3373,7 +3373,7 @@ return IXGBE_SUCCESS; } - if (buffer && ((u32)start + (u32)length > buffer_size)) + if (buffer && ((u32)ptr + (u32)start + (u32)length > buffer_size)) return IXGBE_ERR_PARAM; for (i = start; length; i++, length--) { @@ -3427,7 +3427,7 @@ } local_buffer = eeprom_ptrs; } else { - if (buffer_size < IXGBE_EEPROM_LAST_WORD) + if (buffer_size < IXGBE_EEPROM_LAST_WORD + 1) return IXGBE_ERR_PARAM; local_buffer = buffer; } |