diff options
| author | Nathan Whitehorn <nwhitehorn@FreeBSD.org> | 2010-09-02 22:26:49 +0000 |
|---|---|---|
| committer | Nathan Whitehorn <nwhitehorn@FreeBSD.org> | 2010-09-02 22:26:49 +0000 |
| commit | fa942e6074cceb526256643911d778d6fbd8a1b8 (patch) | |
| tree | e532ff7c7f0cc5b834d62372b4c4ce7cdf09f34f /sys/boot/ofw/libofw/ofw_copy.c | |
| parent | 287cf3e528014022d03a4e76d62cb7a650d1c68d (diff) | |
| download | src-fa942e6074cceb526256643911d778d6fbd8a1b8.tar.gz src-fa942e6074cceb526256643911d778d6fbd8a1b8.zip | |
In the case of non-sequential mappings, ofw_mapmem() could ask Open
Firmware to map a memory region with negative length, causing crashes
and Undefined Behavior. Add the appropriate check to make the behavior
defined.
Notes
Notes:
svn path=/head/; revision=212165
Diffstat (limited to 'sys/boot/ofw/libofw/ofw_copy.c')
| -rw-r--r-- | sys/boot/ofw/libofw/ofw_copy.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/boot/ofw/libofw/ofw_copy.c b/sys/boot/ofw/libofw/ofw_copy.c index 93e7ec656d04..781d4233a014 100644 --- a/sys/boot/ofw/libofw/ofw_copy.c +++ b/sys/boot/ofw/libofw/ofw_copy.c @@ -68,7 +68,7 @@ ofw_mapmem(vm_offset_t dest, const size_t len) /* * Trim area covered by existing mapping, if any */ - if (dest < (last_dest + last_len)) { + if (dest < (last_dest + last_len) && dest >= last_dest) { nlen -= (last_dest + last_len) - dest; dest = last_dest + last_len; } |