Module Name: src
Committed By: jmcneill
Date: Sat Jul 24 11:36:41 UTC 2021
Modified Files:
src/sys/dev/acpi: acpi_dev.c
Log Message:
acpi: /dev/acpi: fix bounds check when reading tables
To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 src/sys/dev/acpi/acpi_dev.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_dev.c
diff -u src/sys/dev/acpi/acpi_dev.c:1.1 src/sys/dev/acpi/acpi_dev.c:1.2
--- src/sys/dev/acpi/acpi_dev.c:1.1 Sun Dec 6 02:57:30 2020
+++ src/sys/dev/acpi/acpi_dev.c Sat Jul 24 11:36:41 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $ */
+/* $NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $ */
/*-
* Copyright (c) 2020 Jared McNeill <[email protected]>
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@@ -208,7 +208,7 @@ acpi_read(dev_t dev, struct uio *uio, in
/* Copy the contents of the table to user-space */
pa = uio->uio_offset;
- len = uimin(pa - table_pa + table_len, uio->uio_resid);
+ len = uimin(table_len - (pa - table_pa), uio->uio_resid);
data = AcpiOsMapMemory(pa, len);
if (data == NULL) {
return ENOMEM;
