Author: mdf
Date: Mon Feb 14 17:20:20 2011
New Revision: 218685
URL: http://svn.freebsd.org/changeset/base/218685
Log:
Prevent reading from the ACPI_RESOURCE past its actual end. For
paranoia limit to the size of the ACPI_RESOURCE as well.
Reviewd by: jhb (in spirit)
MFC after: 1 week
Modified:
head/sys/dev/acpica/acpi_resource.c
Modified: head/sys/dev/acpica/acpi_resource.c
==============================================================================
--- head/sys/dev/acpica/acpi_resource.c Mon Feb 14 16:54:03 2011
(r218684)
+++ head/sys/dev/acpica/acpi_resource.c Mon Feb 14 17:20:20 2011
(r218685)
@@ -60,6 +60,7 @@ static ACPI_STATUS
acpi_lookup_irq_handler(ACPI_RESOURCE *res, void *context)
{
struct lookup_irq_request *req;
+ size_t len;
u_int irqnum, irq;
switch (res->Type) {
@@ -82,7 +83,10 @@ acpi_lookup_irq_handler(ACPI_RESOURCE *r
req->found = 1;
KASSERT(irq == rman_get_start(req->res),
("IRQ resources do not match"));
- bcopy(res, req->acpi_res, sizeof(ACPI_RESOURCE));
+ len = res->Length;
+ if (len > sizeof(ACPI_RESOURCE))
+ len = sizeof(ACPI_RESOURCE);
+ bcopy(res, req->acpi_res, len);
return (AE_CTRL_TERMINATE);
}
return (AE_OK);
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
