Author: mdf Date: Mon Feb 14 17:20:20 2011 New Revision: 218685 URL: http://svn.freebsd.org/changeset/base/218685
Log: Prevent reading from the ACPI_RESOURCE past its actual end. For paranoia limit to the size of the ACPI_RESOURCE as well. Reviewd by: jhb (in spirit) MFC after: 1 week Modified: head/sys/dev/acpica/acpi_resource.c Modified: head/sys/dev/acpica/acpi_resource.c ============================================================================== --- head/sys/dev/acpica/acpi_resource.c Mon Feb 14 16:54:03 2011 (r218684) +++ head/sys/dev/acpica/acpi_resource.c Mon Feb 14 17:20:20 2011 (r218685) @@ -60,6 +60,7 @@ static ACPI_STATUS acpi_lookup_irq_handler(ACPI_RESOURCE *res, void *context) { struct lookup_irq_request *req; + size_t len; u_int irqnum, irq; switch (res->Type) { @@ -82,7 +83,10 @@ acpi_lookup_irq_handler(ACPI_RESOURCE *r req->found = 1; KASSERT(irq == rman_get_start(req->res), ("IRQ resources do not match")); - bcopy(res, req->acpi_res, sizeof(ACPI_RESOURCE)); + len = res->Length; + if (len > sizeof(ACPI_RESOURCE)) + len = sizeof(ACPI_RESOURCE); + bcopy(res, req->acpi_res, len); return (AE_CTRL_TERMINATE); } return (AE_OK); _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"