From d229332a33feb23d9ca9f3869ec7c4e4b09a990f Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Thu, 3 Jul 2014 12:31:20 -0400 Subject: [PATCH] CIDs 1162783 & 1162784: out-of-bounds access & write in MSI. * The number of IO vectors is not 256 on x86, but rather 224 as set by NUM_IO_VECTORS in "arch_int.h". * Jessicah mentioned hearing about MSI crashes before, but that was a few weeks ago. * These were the only CIDs in the MSI code. Signed-off-by: Michael Lotz --- src/system/kernel/arch/x86/msi.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/system/kernel/arch/x86/msi.cpp b/src/system/kernel/arch/x86/msi.cpp index 4578e14d19..64dc74ae45 100644 --- a/src/system/kernel/arch/x86/msi.cpp +++ b/src/system/kernel/arch/x86/msi.cpp @@ -57,7 +57,7 @@ msi_allocate_vectors(uint8 count, uint8 *startVector, uint64 *address, if (result != B_OK) return result; - if (vector >= 256) { + if (vector >= NUM_IO_VECTORS) { free_io_interrupt_vectors(count, vector); return B_NO_MEMORY; }