Date: Thu, 2 Jun 2016 22:03:29 -0700 From: Adrian Chadd <adrian@freebsd.org> To: "src-committers@freebsd.org" <src-committers@freebsd.org>, "svn-src-all@freebsd.org" <svn-src-all@freebsd.org>, "svn-src-head@freebsd.org" <svn-src-head@freebsd.org> Subject: Re: svn commit: r301236 - head/sys/dev/drm2 Message-ID: <CAJ-Vmo=MuwsNPwruz-=%2BnP2Ot4oMyD=A1nPZBOTapRrA4ug=Zg@mail.gmail.com> In-Reply-To: <201606030501.u5351ZMg035703@repo.freebsd.org> References: <201606030501.u5351ZMg035703@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
fwiw, this made me cry. a lot. grr. -adrian On 2 June 2016 at 22:01, Adrian Chadd <adrian@freebsd.org> wrote: > Author: adrian > Date: Fri Jun 3 05:01:35 2016 > New Revision: 301236 > URL: https://svnweb.freebsd.org/changeset/base/301236 > > Log: > [drm] fix up hex_dump_to_buffer to not overflow linebuf. > > That check wasn't enough to handle appending a two byte character > following it. > > This prevented my T400 (Intel Core 2 Duo P8400) from attaching; > it would panic from a stack overflow detection. > > Modified: > head/sys/dev/drm2/drm_os_freebsd.c > > Modified: head/sys/dev/drm2/drm_os_freebsd.c > ============================================================================== > --- head/sys/dev/drm2/drm_os_freebsd.c Fri Jun 3 03:40:39 2016 (r301235) > +++ head/sys/dev/drm2/drm_os_freebsd.c Fri Jun 3 05:01:35 2016 (r301236) > @@ -422,7 +422,7 @@ hex_dump_to_buffer(const void *buf, size > } > } > > - if (j > linebuflen - 1) > + if (j > linebuflen - 4) > break; > > sprintf(linebuf + j, "%02X", c); >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ-Vmo=MuwsNPwruz-=%2BnP2Ot4oMyD=A1nPZBOTapRrA4ug=Zg>