⬢ DragonFlyBSD Kernel Audit
DF-5478 / fix.diff
← back to finding ↓ download raw
--- a/sys/platform/pc64/x86_64/efirt.c
+++ b/sys/platform/pc64/x86_64/efirt.c
@@ -252,7 +252,8 @@
 				    i);
 			goto fail;
 		}
-		if (p->md_phys + p->md_pages * EFI_PAGE_SIZE < p->md_phys ||
+		if (p->md_pages >= VM_MAX_USER_ADDRESS / EFI_PAGE_SIZE ||
+		    p->md_phys + p->md_pages * EFI_PAGE_SIZE < p->md_phys ||
 		    p->md_phys + p->md_pages * EFI_PAGE_SIZE >=
 		    VM_MAX_USER_ADDRESS) {
 			kprintf("EFI Runtime entry %d is not in mappable for RT:"