[src/netbsd-9]: src/sys/arch/i386/stand/lib Pull up following revision(s) (re...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4a2a6625bec4
branches:  netbsd-9
changeset: 1000668:4a2a6625bec4
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Aug 13 14:46:04 2019 +0000

description:
Pull up following revision(s) (requested by manu in ticket #51):

        sys/arch/i386/stand/lib/bootinfo_biosgeom.c: revision 1.24

Fix buffer overflow in BIOS disk geometry collect for bootinfo

This spares a boot-time panic on iMac with fusion drive, which
feature both a hard drive and a solid-state drive.

diffstat:

 sys/arch/i386/stand/lib/bootinfo_biosgeom.c |  13 ++++++++-----
 1 files changed, 8 insertions(+), 5 deletions(-)

diffs (39 lines):

diff -r d5446221e406 -r 4a2a6625bec4 sys/arch/i386/stand/lib/bootinfo_biosgeom.c
--- a/sys/arch/i386/stand/lib/bootinfo_biosgeom.c       Tue Aug 13 14:44:37 2019 +0000
+++ b/sys/arch/i386/stand/lib/bootinfo_biosgeom.c       Tue Aug 13 14:46:04 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bootinfo_biosgeom.c,v 1.23 2017/01/24 11:09:14 nonaka Exp $    */
+/*     $NetBSD: bootinfo_biosgeom.c,v 1.23.18.1 2019/08/13 14:46:04 martin Exp $       */
 
 /*
  * Copyright (c) 1997
@@ -60,6 +60,7 @@
 bi_getbiosgeom(void)
 {
        struct btinfo_biosgeom *bibg;
+       size_t bibg_len = sizeof(*bibg);
        int i, j, nvalid;
        int nhd;
        unsigned int cksum;
@@ -72,8 +73,8 @@
        printf("nhd %d\n", nhd);
 #endif
 
-       bibg = alloc(sizeof(struct btinfo_biosgeom)
-                    + (nhd - 1) * sizeof(struct bi_biosgeom_entry));
+       bibg_len += nhd * sizeof(struct bi_biosgeom_entry); 
+       bibg = alloc(bibg_len);
        if (bibg == NULL)
                return;
 
@@ -175,6 +176,8 @@
 
        bibg->num = nvalid;
 
-       BI_ADD(bibg, BTINFO_BIOSGEOM, sizeof(struct btinfo_biosgeom)
-              + nvalid * sizeof(struct bi_biosgeom_entry));
+       if (nvalid < nhd)
+               bibg_len -= (nhd - nvalid) * sizeof(struct bi_biosgeom_entry);
+
+       BI_ADD(bibg, BTINFO_BIOSGEOM, bibg_len);
 }