svn commit: r350630 - head/sys/dev/oce

Kyle Evans kevans at FreeBSD.org
Tue Aug 6 13:09:21 UTC 2019


Author: kevans
Date: Tue Aug  6 13:09:20 2019
New Revision: 350630
URL: https://svnweb.freebsd.org/changeset/base/350630

Log:
  oce(4): potential out of bounds access before vector validation
  
  Submitted by:	Augustin Cavalier <waddlesplash at gmail.com>
  Obtained from:	Haiku (ec2b89264cfc63e05e611cce82cc449197403aa4)
  MFC after:	3 days

Modified:
  head/sys/dev/oce/oce_if.c

Modified: head/sys/dev/oce/oce_if.c
==============================================================================
--- head/sys/dev/oce/oce_if.c	Tue Aug  6 12:19:09 2019	(r350629)
+++ head/sys/dev/oce/oce_if.c	Tue Aug  6 13:09:20 2019	(r350630)
@@ -836,11 +836,13 @@ oce_fast_isr(void *arg)
 static int
 oce_alloc_intr(POCE_SOFTC sc, int vector, void (*isr) (void *arg, int pending))
 {
-	POCE_INTR_INFO ii = &sc->intrs[vector];
+	POCE_INTR_INFO ii;
 	int rc = 0, rr;
 
 	if (vector >= OCE_MAX_EQ)
 		return (EINVAL);
+
+	ii = &sc->intrs[vector];
 
 	/* Set the resource id for the interrupt.
 	 * MSIx is vector + 1 for the resource id,


More information about the svn-src-all mailing list