⬢ DragonFlyBSD Kernel Audit
DF-3911 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
--- a/sys/dev/disk/mpt/mpt.c
+++ b/sys/dev/disk/mpt/mpt.c
@@ -2465,6 +2465,12 @@
 		  MPI_DIAG_RW_ENABLE|MPI_DIAG_DISABLE_ARM);
 
 	fw_hdr = (MpiFwHeader_t *)mpt->fw_image;
+	if (fw_hdr->ImageSize == 0 ||
+	    fw_hdr->ImageSize > mpt->fw_image_size) {
+		mpt_prt(mpt, "bad firmware image size %u\n",
+		    fw_hdr->ImageSize);
+		return (EIO);
+	}
 	bus_dmamap_sync(mpt->fw_dmat, mpt->fw_dmap, BUS_DMASYNC_PREWRITE);
 	mpt_diag_outsl(mpt, fw_hdr->LoadStartAddress, (uint32_t*)fw_hdr,
 		       fw_hdr->ImageSize);
@@ -2474,7 +2480,17 @@
 	while (ext_offset != 0) {
 		MpiExtImageHeader_t *ext;
 
+		if (ext_offset < sizeof(MpiFwHeader_t) ||
+		    ext_offset > mpt->fw_image_size - sizeof(MpiExtImageHeader_t)) {
+			mpt_prt(mpt, "bad ext image offset %u\n", ext_offset);
+			return (EIO);
+		}
 		ext = (MpiExtImageHeader_t *)((uintptr_t)fw_hdr + ext_offset);
+		if (ext->ImageSize == 0 ||
+		    ext->ImageSize > mpt->fw_image_size - ext_offset) {
+			mpt_prt(mpt, "bad ext image size %u\n", ext->ImageSize);
+			return (EIO);
+		}
 		ext_offset = ext->NextImageHeaderOffset;
 		bus_dmamap_sync(mpt->fw_dmat, mpt->fw_dmap,
 		    BUS_DMASYNC_PREWRITE);