summaryrefslogtreecommitdiff
path: root/sys/dev/microcode
diff options
context:
space:
mode:
authormaxv <maxv@NetBSD.org>2016-08-15 08:52:33 +0000
committermaxv <maxv@NetBSD.org>2016-08-15 08:52:33 +0000
commitd3565c4956cb3188ef62322f7f1092a64d5dc697 (patch)
treedecd48eac4f7eb379900a4aa25353c785f1dd92c /sys/dev/microcode
parent3d8a2c88ea62e52ef56f192bba5ecaf007885661 (diff)
This thing is completely buggy. There is a use-after-free and NULL pointer
dereference. Just fix the uaf, and add a comment. Not tested, but obvious enough; found by brainy.
Diffstat (limited to 'sys/dev/microcode')
-rw-r--r--sys/dev/microcode/aic7xxx/aicasm.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/dev/microcode/aic7xxx/aicasm.c b/sys/dev/microcode/aic7xxx/aicasm.c
index 65b1bbb1fed..cf637fb7b25 100644
--- a/sys/dev/microcode/aic7xxx/aicasm.c
+++ b/sys/dev/microcode/aic7xxx/aicasm.c
@@ -1,4 +1,4 @@
-/* $NetBSD: aicasm.c,v 1.8 2009/12/27 16:03:49 jakllsch Exp $ */
+/* $NetBSD: aicasm.c,v 1.9 2016/08/15 08:52:33 maxv Exp $ */
/*
* Aic7xxx SCSI host adapter firmware asssembler
@@ -43,7 +43,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: aicasm.c,v 1.8 2009/12/27 16:03:49 jakllsch Exp $");
+__RCSID("$NetBSD: aicasm.c,v 1.9 2016/08/15 08:52:33 maxv Exp $");
#include <sys/types.h>
#include <sys/mman.h>
@@ -595,6 +595,7 @@ output_listing(char *ifilename)
putchar(input);
}
free(func_values);
+ func_values = NULL;
fprintf(stdout, "\nThanks!\n");
}
@@ -604,6 +605,11 @@ output_listing(char *ifilename)
cur_instr != NULL;
cur_instr = STAILQ_NEXT(cur_instr, links), instrcount++) {
+ /*
+ * XXX XXX XXX: What exactly are we trying to do here?
+ * 'func_values' is always NULL, so check_patch will
+ * necessarily crash.
+ */
if (check_patch(&cur_patch, instrcount,
&skip_addr, func_values) == 0) {
/* Don't count this instruction as it is in a patch