From 6102514531074825936a85a1d7f609aa9ab5eb88 Mon Sep 17 00:00:00 2001 From: kib Date: Mon, 23 May 2016 00:58:52 +0000 Subject: [PATCH] MFC r300305, r300332: Check for overflow and return EINVAL if detected. Use unsigned index. git-svn-id: svn://svn.freebsd.org/base/stable/10@300441 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/amd64/amd64/sys_machdep.c | 6 ++++-- sys/i386/i386/sys_machdep.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index ff3bd3edc..77abfe8d8 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -334,18 +334,20 @@ amd64_set_ioperm(td, uap) struct thread *td; struct i386_ioperm_args *uap; { - int i, error; char *iomap; struct amd64tss *tssp; struct system_segment_descriptor *tss_sd; u_long *addr; struct pcb *pcb; + u_int i; + int error; if ((error = priv_check(td, PRIV_IO)) != 0) return (error); if ((error = securelevel_gt(td->td_ucred, 0)) != 0) return (error); - if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) + if (uap->start > uap->start + uap->length || + uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) return (EINVAL); /* diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c index d095db2bd..eb1e81937 100644 --- a/sys/i386/i386/sys_machdep.c +++ b/sys/i386/i386/sys_machdep.c @@ -344,8 +344,9 @@ i386_set_ioperm(td, uap) struct thread *td; struct i386_ioperm_args *uap; { - int i, error; char *iomap; + u_int i; + int error; if ((error = priv_check(td, PRIV_IO)) != 0) return (error); @@ -363,7 +364,8 @@ i386_set_ioperm(td, uap) return (error); iomap = (char *)td->td_pcb->pcb_ext->ext_iomap; - if (uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) + if (uap->start > uap->start + uap->length || + uap->start + uap->length > IOPAGES * PAGE_SIZE * NBBY) return (EINVAL); for (i = uap->start; i < uap->start + uap->length; i++) { -- 2.45.0