From 8b0a738288f8e63f247c75ec1d1055b2d9509492 Mon Sep 17 00:00:00 2001 From: Colin Percival Date: Wed, 6 Dec 2006 09:13:51 +0000 Subject: Correct a signedness bug which allowed members of the operator group to read kernel memory. Security: FreeBSD-SA-06:25.kmem --- sys/dev/firewire/fwdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys/dev/firewire/fwdev.c') diff --git a/sys/dev/firewire/fwdev.c b/sys/dev/firewire/fwdev.c index e42c30a78c977..5b461906f432c 100644 --- a/sys/dev/firewire/fwdev.c +++ b/sys/dev/firewire/fwdev.c @@ -712,7 +712,7 @@ out: else len = fwdev->rommax - CSRROMOFF + 4; } - if (crom_buf->len < len) + if (crom_buf->len < len && crom_buf->len >= 0) len = crom_buf->len; else crom_buf->len = len; -- cgit v1.3