Sat Jul 24 11:36:41 2021 UTC ()
acpi: /dev/acpi: fix bounds check when reading tables


(jmcneill)
diff -r1.1 -r1.2 src/sys/dev/acpi/acpi_dev.c

cvs diff -r1.1 -r1.2 src/sys/dev/acpi/acpi_dev.c (expand / switch to context diff)
--- src/sys/dev/acpi/acpi_dev.c 2020/12/06 02:57:30 1.1
+++ src/sys/dev/acpi/acpi_dev.c 2021/07/24 11:36:41 1.2
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $ */
+/* $NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $ */
 
 /*-
  * Copyright (c) 2020 Jared McNeill <jmcneill@invisible.ca>
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $");
 
 #include <sys/param.h>
 #include <sys/conf.h>
@@ -208,7 +208,7 @@
 
 	/* Copy the contents of the table to user-space */
 	pa = uio->uio_offset;
-	len = uimin(pa - table_pa + table_len, uio->uio_resid);
+	len = uimin(table_len - (pa - table_pa), uio->uio_resid);
 	data = AcpiOsMapMemory(pa, len);
 	if (data == NULL) {
 		return ENOMEM;