1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-19 10:53:58 +00:00

Correct a signedness bug which allowed members of the operator

group to read kernel memory.

Security:	FreeBSD-SA-06:25.kmem
This commit is contained in:
Colin Percival 2006-12-06 09:13:51 +00:00
parent fc6c30f6c6
commit 8b0a738288
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=164940

View File

@ -712,7 +712,7 @@ fw_ioctl (struct cdev *dev, u_long cmd, caddr_t data, int flag, fw_proc *td)
else
len = fwdev->rommax - CSRROMOFF + 4;
}
if (crom_buf->len < len)
if (crom_buf->len < len && crom_buf->len >= 0)
len = crom_buf->len;
else
crom_buf->len = len;