⬢ DragonFlyBSD Kernel Audit
DF-3756 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
--- a/sys/dev/netif/de/if_de.c
+++ b/sys/dev/netif/de/if_de.c
@@ -2078,10 +2078,12 @@ tulip_srom_decode(tulip_softc_t *sc)
     tulip_srom_media_t srom_media;
     tulip_media_info_t *mi = sc->tulip_mediainfo;
     const uint8_t *dp;
     uint32_t leaf_offset, blocks, data;
+    const tulip_media_info_t * const l_mi_end =
+	&sc->tulip_mediainfo[__arraycount(sc->tulip_mediainfo)];
 
     for (idx1 = 0; idx1 < shp->sh_adapter_count; idx1++, saip++) {
 	if (shp->sh_adapter_count == 1)
 	    break;
@@ -2119,6 +2121,10 @@ tulip_srom_decode(tulip_softc_t *sc)
     if (sc->tulip_chipid == TULIP_21041) {
 	blocks = *dp++;
 	for (idx2 = 0; idx2 < blocks; idx2++) {
+	    if (mi >= l_mi_end) {
+		/* no more media slots: stop decoding blocks */
+		break;
+	    }
 	    tulip_media_t media;
 	    data = *dp++;
 	    srom_media = (tulip_srom_media_t) (data & 0x3F);
@@ -2182,6 +2188,10 @@ tulip_srom_decode(tulip_softc_t *sc)
 	    sc->tulip_gpinit = *dp++;
 	blocks = *dp++;
 	for (idx2 = 0; idx2 < blocks; idx2++) {
+	    if (mi >= l_mi_end) {
+		/* no more media slots: stop decoding blocks */
+		break;
+	    }
 	    const uint8_t *ep;
 	    if ((*dp & 0x80) == 0) {
 		length = 4;