Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F102733915
D38127.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Flag For Later
Award Token
Size
1 KB
Referenced Files
None
Subscribers
None
D38127.diff
View Options
diff --git a/usr.sbin/bhyve/pci_hda.c b/usr.sbin/bhyve/pci_hda.c
--- a/usr.sbin/bhyve/pci_hda.c
+++ b/usr.sbin/bhyve/pci_hda.c
@@ -30,6 +30,7 @@
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
+#include <sys/param.h>
#include <time.h>
#include "pci_hda.h"
@@ -51,8 +52,6 @@
#define HDA_CODEC_MAX 0x0f
#define HDA_LAST_OFFSET \
(0x2084 + ((HDA_ISS_NO) * 0x20) + ((HDA_OSS_NO) * 0x20))
-#define HDA_SET_REG_TABLE_SZ \
- (0x80 + ((HDA_ISS_NO) * 0x20) + ((HDA_OSS_NO) * 0x20))
#define HDA_CORB_ENTRY_LEN 0x04
#define HDA_RIRB_ENTRY_LEN 0x08
#define HDA_BDL_ENTRY_LEN 0x10
@@ -246,8 +245,6 @@
HDAC_OSTREAM(1, HDA_ISS_NO, HDA_OSS_NO)
HDAC_OSTREAM(2, HDA_ISS_NO, HDA_OSS_NO)
HDAC_OSTREAM(3, HDA_ISS_NO, HDA_OSS_NO)
-
- [HDA_SET_REG_TABLE_SZ] = NULL,
};
static const uint16_t hda_corb_sizes[] = {
@@ -714,7 +711,10 @@
uint32_t old = hda_get_reg_by_offset(sc, offset);
uint32_t masks[] = {0x00000000, 0x000000ff, 0x0000ffff,
0x00ffffff, 0xffffffff};
- hda_set_reg_handler set_reg_handler = hda_set_reg_table[offset];
+ hda_set_reg_handler set_reg_handler = NULL;
+
+ if (offset < nitems(hda_set_reg_table))
+ set_reg_handler = hda_set_reg_table[offset];
hda_set_field_by_offset(sc, offset, masks[size], value);
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Sun, Nov 17, 12:22 PM (21 h, 56 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
14677219
Default Alt Text
D38127.diff (1 KB)
Attached To
Mode
D38127: bhyve: Fix a global buffer overread in the PCI hda device model.
Attached
Detach File
Event Timeline
Log In to Comment