Author: landonf Date: Sun Jul 10 00:08:40 2016 New Revision: 302509 URL: https://svnweb.freebsd.org/changeset/base/302509
Log: Fix heap overflow in bhnd(4) SPROM parsing. The bus_region_* APIs accept the number of data items to be read, while the code was passing the total number of bytes, resulting in an overflow of the SPROM parser's buffer. Approved by: adrian (mentor) Differential Revision: https://reviews.freebsd.org/D7168 Modified: head/sys/dev/bhnd/nvram/bhnd_sprom_subr.c Modified: head/sys/dev/bhnd/nvram/bhnd_sprom_subr.c ============================================================================== --- head/sys/dev/bhnd/nvram/bhnd_sprom_subr.c Sat Jul 9 23:22:44 2016 (r302508) +++ head/sys/dev/bhnd/nvram/bhnd_sprom_subr.c Sun Jul 10 00:08:40 2016 (r302509) @@ -523,7 +523,8 @@ sprom_direct_read(struct bhnd_sprom *sc, p = (uint16_t *)buf; res_offset = sc->sp_res_off + offset; - bhnd_bus_read_region_stream_2(sc->sp_res, res_offset, p, nbytes); + bhnd_bus_read_region_stream_2(sc->sp_res, res_offset, p, + (nbytes / sizeof(uint16_t))); *crc = bhnd_nvram_crc8(p, nbytes, *crc); return (0); _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "[email protected]"
