Date: Wed, 18 Jun 2014 13:41:20 +0000 (UTC) From: Roger Pau Monné <royger@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r267607 - head/sys/x86/xen Message-ID: <201406181341.s5IDfKwG065439@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: royger Date: Wed Jun 18 13:41:20 2014 New Revision: 267607 URL: http://svnweb.freebsd.org/changeset/base/267607 Log: xen: fix out-of-bounds access to ipi_handle Fix the gate in xen_pv_lapic_ipi_vectored to prevent access to element at position nitems(xen_ipis). Sponsored by: Citrix Systems R&D Coverity ID: 1223203 Approved by: gibbs Modified: head/sys/x86/xen/xen_apic.c Modified: head/sys/x86/xen/xen_apic.c ============================================================================== --- head/sys/x86/xen/xen_apic.c Wed Jun 18 12:26:02 2014 (r267606) +++ head/sys/x86/xen/xen_apic.c Wed Jun 18 13:41:20 2014 (r267607) @@ -272,7 +272,7 @@ xen_pv_lapic_ipi_vectored(u_int vector, int ipi_idx, to_cpu, self; ipi_idx = IPI_TO_IDX(vector); - if (ipi_idx > nitems(xen_ipis)) + if (ipi_idx >= nitems(xen_ipis)) panic("IPI out of range"); switch(dest) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201406181341.s5IDfKwG065439>