diff options
| author | Jasper Lievisse Adriaanse <jasper@cvs.openbsd.org> | 2022-08-21 12:52:11 +0000 |
|---|---|---|
| committer | Jasper Lievisse Adriaanse <jasper@cvs.openbsd.org> | 2022-08-21 12:52:11 +0000 |
| commit | 7ad677aafb2ea8ac8cbb8c513425581fb8d4c64a (patch) | |
| tree | ac829def28966fae650d63c85a6c395ee336e43c /sys | |
| parent | da1df7b9c50b0b038fa78fd6fa36e95aec60afa7 (diff) | |
prevent buffer overflow in OF_getpropint64array()
just like -r1.28 did for OF_getpropintarray()
ok kettenis@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/ofw/fdt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ofw/fdt.c b/sys/dev/ofw/fdt.c index def626ab548..9de907d6693 100644 --- a/sys/dev/ofw/fdt.c +++ b/sys/dev/ofw/fdt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: fdt.c,v 1.29 2022/08/06 08:59:28 kettenis Exp $ */ +/* $OpenBSD: fdt.c,v 1.30 2022/08/21 12:52:10 jasper Exp $ */ /* * Copyright (c) 2009 Dariusz Swiderski <sfires@sfires.net> @@ -1023,7 +1023,7 @@ OF_getpropint64array(int handle, char *prop, uint64_t *buf, int buflen) if (len < 0 || (len % sizeof(uint64_t))) return -1; - for (i = 0; i < len / sizeof(uint64_t); i++) + for (i = 0; i < min(len, buflen) / sizeof(uint64_t); i++) buf[i] = betoh64(buf[i]); return len; |