upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 00:32:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

In the case of non-sequential mappings, ofw_mapmem() could ask Open

Browse source 
Firmware to map a memory region with negative length, causing crashes
and Undefined Behavior. Add the appropriate check to make the behavior
defined.
This commit is contained in:
Nathan Whitehorn 2010-09-02 22:26:49 +00:00
parent 287cf3e528
commit fa942e6074
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/boot/ofw/libofw/ofw_copy.c
View file

@ -68,7 +68,7 @@ ofw_mapmem(vm_offset_t dest, const size_t len)
/*
* Trim area covered by existing mapping, if any
*/
if (dest < (last_dest + last_len)) {
if (dest < (last_dest + last_len) && dest >= last_dest) {
nlen -= (last_dest + last_len) - dest;
dest = last_dest + last_len;
}