Date: Mon, 25 Nov 2019 21:21:37 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r355101 - head/sys/dev/cfi Message-ID: <201911252121.xAPLLbpN041510@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Mon Nov 25 21:21:37 2019 New Revision: 355101 URL: https://svnweb.freebsd.org/changeset/base/355101 Log: cfi: check for inter overflow in cfi_devioctl Reported by: Pietro Oliva Reviewed by: markj MFC after: 3 days Security: Possible OOB read in root-only ioctl Sponsored by: The FreeBSD Foundation Modified: head/sys/dev/cfi/cfi_dev.c Modified: head/sys/dev/cfi/cfi_dev.c ============================================================================== --- head/sys/dev/cfi/cfi_dev.c Mon Nov 25 19:59:53 2019 (r355100) +++ head/sys/dev/cfi/cfi_dev.c Mon Nov 25 21:21:37 2019 (r355101) @@ -280,7 +280,8 @@ cfi_devioctl(struct cdev *dev, u_long cmd, caddr_t dat rq = (struct cfiocqry *)data; if (rq->offset >= sc->sc_size / sc->sc_width) return (ESPIPE); - if (rq->offset + rq->count > sc->sc_size / sc->sc_width) + if (rq->offset > ULONG_MAX - rq->count || + rq->offset + rq->count > sc->sc_size / sc->sc_width) return (ENOSPC); while (!error && rq->count--) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201911252121.xAPLLbpN041510>