Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The correct number of elements to insert into cmd_iohs is WDC_NREG. Using 

larger numbers risks a buffer overflow and panic.  Bug spotted by Mike Pumford.
Patch compile-tested only, but it's obviously correct.
This commit is contained in:
bjh21 2006-10-09 21:12:44 +00:00
parent 71ba9763cb
commit d6e105789d
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/arch/acorn32/podulebus/icside.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: icside.c,v 1.25 2006/01/16 20:30:18 bouyer Exp $ */
/* $NetBSD: icside.c,v 1.26 2006/10/09 21:12:44 bjh21 Exp $ */
/*
* Copyright (c) 1997-1998 Mark Brinicombe
@ -42,7 +42,7 @@
#include <sys/param.h>
__KERNEL_RCSID(0, "$NetBSD: icside.c,v 1.25 2006/01/16 20:30:18 bouyer Exp $");
__KERNEL_RCSID(0, "$NetBSD: icside.c,v 1.26 2006/10/09 21:12:44 bjh21 Exp $");
#include <sys/systm.h>
#include <sys/conf.h>
@ -280,7 +280,7 @@ icside_attach(struct device *parent, struct device *self, void *aux)
if (bus_space_map(iot, iobase + ide->ideregs[channel],
IDE_REGISTER_SPACE, 0, &wdr->cmd_baseioh))
return;
for (i = 0; i < IDE_REGISTER_SPACE; i++) {
for (i = 0; i < WDC_NREG; i++) {
if (bus_space_subregion(wdr->cmd_iot, wdr->cmd_baseioh,
i, i == 0 ? 4 : 1, &wdr->cmd_iohs[i]) != 0)
return;

6
sys/arch/acorn32/podulebus/rapide.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: rapide.c,v 1.24 2006/01/16 20:30:18 bouyer Exp $ */
/* $NetBSD: rapide.c,v 1.25 2006/10/09 21:12:44 bjh21 Exp $ */
/*
* Copyright (c) 1997-1998 Mark Brinicombe
@ -68,7 +68,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: rapide.c,v 1.24 2006/01/16 20:30:18 bouyer Exp $");
__KERNEL_RCSID(0, "$NetBSD: rapide.c,v 1.25 2006/10/09 21:12:44 bjh21 Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -271,7 +271,7 @@ rapide_attach(parent, self, aux)
if (bus_space_map(iot, iobase + rapide_info[channel].registers,
DRIVE_REGISTERS_SPACE, 0, &wdr->cmd_baseioh))
continue;
for (i = 0; i < DRIVE_REGISTERS_SPACE; i++) {
for (i = 0; i < WDC_NREG; i++) {
if (bus_space_subregion(wdr->cmd_iot, wdr->cmd_baseioh,
i, i == 0 ? 4 : 1, &wdr->cmd_iohs[i]) != 0) {
bus_space_unmap(iot, wdr->cmd_baseioh,