CVS: cvs.openbsd.org: src
Kirill A. Korinsky <[email protected]> Mon, 27 Jul 2026 07:45:10 -0600 (MDT)
| Newsgroups | gmane.os.openbsd.cvs |
|---|---|
| Message-ID | <[email protected]> |
CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/07/27 07:45:10 Modified files: sys/arch/macppc/macppc: openfirm.c Log message: sys/macppc: bound OF_getprop() bounce copy The Open Firmware getprop service returns the full property size while copying at most buflen bytes. macppc redirects the firmware write through OF_buf, but copied the returned size into the caller's buffer, allowing an oversized property to overwrite adjacent memory. Here, I limit the second copy to buflen while preserving getprop's return value. This fixes stack corruption when QEMU OpenBIOS returns the 60 byte e1000 reg property to pci_intr_map(), which requests one 20 byte PCI record. With this change, em0 attaches and the ramdisk reaches the installer. OK: kettenis@, jca@