diff options
| author | maxv <maxv@NetBSD.org> | 2016-08-15 08:52:33 +0000 |
|---|---|---|
| committer | maxv <maxv@NetBSD.org> | 2016-08-15 08:52:33 +0000 |
| commit | d3565c4956cb3188ef62322f7f1092a64d5dc697 (patch) | |
| tree | decd48eac4f7eb379900a4aa25353c785f1dd92c /sys/dev/microcode | |
| parent | 3d8a2c88ea62e52ef56f192bba5ecaf007885661 (diff) | |
This thing is completely buggy. There is a use-after-free and NULL pointer
dereference. Just fix the uaf, and add a comment. Not tested, but obvious
enough; found by brainy.
Diffstat (limited to 'sys/dev/microcode')
| -rw-r--r-- | sys/dev/microcode/aic7xxx/aicasm.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/dev/microcode/aic7xxx/aicasm.c b/sys/dev/microcode/aic7xxx/aicasm.c index 65b1bbb1fed..cf637fb7b25 100644 --- a/sys/dev/microcode/aic7xxx/aicasm.c +++ b/sys/dev/microcode/aic7xxx/aicasm.c @@ -1,4 +1,4 @@ -/* $NetBSD: aicasm.c,v 1.8 2009/12/27 16:03:49 jakllsch Exp $ */ +/* $NetBSD: aicasm.c,v 1.9 2016/08/15 08:52:33 maxv Exp $ */ /* * Aic7xxx SCSI host adapter firmware asssembler @@ -43,7 +43,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: aicasm.c,v 1.8 2009/12/27 16:03:49 jakllsch Exp $"); +__RCSID("$NetBSD: aicasm.c,v 1.9 2016/08/15 08:52:33 maxv Exp $"); #include <sys/types.h> #include <sys/mman.h> @@ -595,6 +595,7 @@ output_listing(char *ifilename) putchar(input); } free(func_values); + func_values = NULL; fprintf(stdout, "\nThanks!\n"); } @@ -604,6 +605,11 @@ output_listing(char *ifilename) cur_instr != NULL; cur_instr = STAILQ_NEXT(cur_instr, links), instrcount++) { + /* + * XXX XXX XXX: What exactly are we trying to do here? + * 'func_values' is always NULL, so check_patch will + * necessarily crash. + */ if (check_patch(&cur_patch, instrcount, &skip_addr, func_values) == 0) { /* Don't count this instruction as it is in a patch |
