From 42cde478e31ccfe1b6520dd6c54d4405e09bffc7 Mon Sep 17 00:00:00 2001 From: Ian Moffett Date: Tue, 3 Jun 2025 16:41:21 -0400 Subject: kernel: device: Harden cdev mmap() bounds checks Signed-off-by: Ian Moffett --- sys/dev/video/fbdev.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'sys/dev') diff --git a/sys/dev/video/fbdev.c b/sys/dev/video/fbdev.c index 391400c..b4b465b 100644 --- a/sys/dev/video/fbdev.c +++ b/sys/dev/video/fbdev.c @@ -45,13 +45,12 @@ static volatile struct limine_framebuffer_request framebuffer_req = { }; static paddr_t -fbdev_mmap(dev_t dev, off_t off, int flags) +fbdev_mmap(dev_t dev, size_t size, off_t off, int flags) { size_t max_bounds; max_bounds = FRAMEBUFFER->pitch * FRAMEBUFFER->height; - max_bounds /= 4; - if (off > max_bounds) { + if ((off + size) > max_bounds) { return 0; } -- cgit v1.2.3