From 87b8309953cabb32e835e2ccf54ca104bb69f089 Mon Sep 17 00:00:00 2001 From: Marius Strobl Date: Sun, 23 Dec 2007 11:31:24 +0000 Subject: MFC: 1.8 In openprom_ioctl() ensure appropriate permissions and that data isn't NULL and doesn't point to a NULL pointer before dereferencing it. Approved by: re (kensmith) --- sys/dev/ofw/openpromio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'sys/dev/ofw') diff --git a/sys/dev/ofw/openpromio.c b/sys/dev/ofw/openpromio.c index ca6aba741af7..cb7343ff6d70 100644 --- a/sys/dev/ofw/openpromio.c +++ b/sys/dev/ofw/openpromio.c @@ -101,12 +101,17 @@ openprom_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, char *buf; int error; + if ((flags & FREAD) == 0) + return (EPERM); + prop = buf = NULL; error = 0; - oprom = *(void **)data; switch (cmd) { case OPROMCHILD: case OPROMNEXT: + if (data == NULL || *(void **)data == NULL) + return (EINVAL); + oprom = *(void **)data; error = copyin(&oprom->oprom_size, &len, sizeof(len)); if (error != 0) break; @@ -135,6 +140,9 @@ openprom_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, break; case OPROMGETPROP: case OPROMNXTPROP: + if (data == NULL || *(void **)data == NULL) + return (EINVAL); + oprom = *(void **)data; error = copyin(&oprom->oprom_size, &len, sizeof(len)); if (error != 0) break; -- cgit v1.3