⬢ DragonFlyBSD Kernel Audit
DF-5363 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -244,8 +244,11 @@
 					 * XXX do more work to deal with
 					 * distant regions
 					 */
+					/* DF-5363: the reads below run to addr +
+					 * tuple.mult * (length - 1), so the bound must
+					 * magnify the length by tuple.mult. */
 					if ((addr >= PCCARD_CIS_SIZE) ||
-					    ((addr + length) >=
+					    (addr + tuple.mult * length >=
 					    PCCARD_CIS_SIZE)) {
 						DPRINTF((" skipped, "
 						    "too distant\n"));