CVS commit: src/sys/dev/pci

[Tonnerre Lombard]

Module Name:    src
Committed By:   tonnerre
Date:           Wed Jan 20 09:05:12 UTC 2010

Modified Files:
        src/sys/dev/pci: azalia.c
        src/sys/dev/pci/hdaudio: hdaudio_afg.c

Log Message:
Signedness bug/crash in azalia and hdaudio. Fixes PR 42604.
By Pierre Pronchery.


To generate a diff of this commit:
cvs rdiff -u -r1.71 -r1.72 src/sys/dev/pci/azalia.c
cvs rdiff -u -r1.18 -r1.19 src/sys/dev/pci/hdaudio/hdaudio_afg.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/pci/azalia.c
diff -u src/sys/dev/pci/azalia.c:1.71 src/sys/dev/pci/azalia.c:1.72
--- src/sys/dev/pci/azalia.c:1.71	Fri Jan  8 19:56:51 2010
+++ src/sys/dev/pci/azalia.c	Wed Jan 20 09:05:12 2010
@@ -1,4 +1,4 @@
-/*	$NetBSD: azalia.c,v 1.71 2010/01/08 19:56:51 dyoung Exp $	*/
+/*	$NetBSD: azalia.c,v 1.72 2010/01/20 09:05:12 tonnerre Exp $	*/
 
 /*-
  * Copyright (c) 2005 The NetBSD Foundation, Inc.
@@ -41,7 +41,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: azalia.c,v 1.71 2010/01/08 19:56:51 dyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: azalia.c,v 1.72 2010/01/20 09:05:12 tonnerre Exp $");
 
 #include <sys/param.h>
 #include <sys/device.h>
@@ -2238,7 +2238,7 @@
 
 	az = v;
 	co = &az->codecs[az->codecno];
-	if (mdev->index >= co->nmixers)
+	if (mdev->index < 0 || mdev->index >= co->nmixers)
 		return ENXIO;
 	*mdev = co->mixers[mdev->index].devinfo;
 	return 0;

Index: src/sys/dev/pci/hdaudio/hdaudio_afg.c
diff -u src/sys/dev/pci/hdaudio/hdaudio_afg.c:1.18 src/sys/dev/pci/hdaudio/hdaudio_afg.c:1.19
--- src/sys/dev/pci/hdaudio/hdaudio_afg.c:1.18	Fri Jan  8 19:56:52 2010
+++ src/sys/dev/pci/hdaudio/hdaudio_afg.c	Wed Jan 20 09:05:12 2010
@@ -1,4 +1,4 @@
-/* $NetBSD: hdaudio_afg.c,v 1.18 2010/01/08 19:56:52 dyoung Exp $ */
+/* $NetBSD: hdaudio_afg.c,v 1.19 2010/01/20 09:05:12 tonnerre Exp $ */
 
 /*
  * Copyright (c) 2009 Precedence Technologies Ltd <supp...@precedence.co.uk>
@@ -60,7 +60,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: hdaudio_afg.c,v 1.18 2010/01/08 19:56:52 dyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: hdaudio_afg.c,v 1.19 2010/01/20 09:05:12 tonnerre Exp $");
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -3500,7 +3500,7 @@
 	struct hdaudio_audiodev *ad = opaque;
 	struct hdaudio_afg_softc *sc = ad->ad_sc;
 
-	if (di->index >= sc->sc_nmixers)
+	if (di->index < 0 || di->index >= sc->sc_nmixers)
 		return ENXIO;
 
 	*di = sc->sc_mixers[di->index].mx_di;