CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/07/27 07:45:10
Modified files:
sys/arch/macppc/macppc: openfirm.c
Log message:
sys/macppc: bound OF_getprop() bounce copy
The Open Firmware getprop service returns the full property size while
copying at most buflen bytes. macppc redirects the firmware write through
OF_buf, but copied the returned size into the caller's buffer, allowing an
oversized property to overwrite adjacent memory.
Here, I limit the second copy to buflen while preserving getprop's return
value.
This fixes stack corruption when QEMU OpenBIOS returns the 60 byte e1000 reg
property to pci_intr_map(), which requests one 20 byte PCI record. With this
change, em0 attaches and the ramdisk reaches the installer.
OK: kettenis@, jca@
