⬢ DragonFlyBSD Kernel Audit
DF-5498 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/firewire/fwcrom.c
+++ b/sys/bus/firewire/fwcrom.c
@@ -463,7 +463,8 @@
 	}
 
 	tl = (struct csrtext *)(void *)&chunk->data;
-	tl->crc_len = howmany(sizeof(struct csrtext) + len, sizeof(u_int32_t));
+	/* quadlets after the crc quadlet: spec/type, lang_id and the text */
+	tl->crc_len = howmany(len, sizeof(u_int32_t)) + 2;
 	tl->spec_id = 0;
 	tl->spec_type = 0;
 	tl->lang_id = 0;