[src/trunk]: src/sys/dev/pci Check bounds more carefully to avoid integer ove...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f210ec8b6177
branches:  trunk
changeset: 329835:f210ec8b6177
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Wed Jun 11 16:45:06 2014 +0000

description:
Check bounds more carefully to avoid integer overflow.

diffstat:

 sys/dev/pci/agp_i810.c |  7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diffs (28 lines):

diff -r 71880b223048 -r f210ec8b6177 sys/dev/pci/agp_i810.c
--- a/sys/dev/pci/agp_i810.c    Wed Jun 11 14:57:55 2014 +0000
+++ b/sys/dev/pci/agp_i810.c    Wed Jun 11 16:45:06 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: agp_i810.c,v 1.88 2014/06/11 14:04:48 riastradh Exp $  */
+/*     $NetBSD: agp_i810.c,v 1.89 2014/06/11 16:45:06 riastradh Exp $  */
 
 /*-
  * Copyright (c) 2000 Doug Rabson
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: agp_i810.c,v 1.88 2014/06/11 14:04:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: agp_i810.c,v 1.89 2014/06/11 16:45:06 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1123,7 +1123,8 @@
                return NULL;
        if ((size & (AGP_PAGE_SIZE - 1)) != 0)
                return NULL;
-       if (sc->as_allocated + size > sc->as_maxmem)
+       KASSERT(sc->as_allocated <= sc->as_maxmem);
+       if (size > (sc->as_maxmem - sc->as_allocated))
                return NULL;
        switch (type) {
        case AGP_I810_MEMTYPE_MAIN: