[src/trunk]: src/sys/dev Improved overflow test for audio_mmap.

[nat <nat%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5b55850709ff
branches:  trunk
changeset: 823858:5b55850709ff
user:      nat <nat%NetBSD.org@localhost>
date:      Thu May 11 23:26:48 2017 +0000

description:
Improved overflow test for audio_mmap.

Ok riastradh@.

diffstat:

 sys/dev/audio.c |  11 ++++-------
 1 files changed, 4 insertions(+), 7 deletions(-)

diffs (39 lines):

diff -r f589f325fc37 -r 5b55850709ff sys/dev/audio.c
--- a/sys/dev/audio.c   Thu May 11 23:20:38 2017 +0000
+++ b/sys/dev/audio.c   Thu May 11 23:26:48 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: audio.c,v 1.338 2017/05/11 23:20:38 nat Exp $  */
+/*     $NetBSD: audio.c,v 1.339 2017/05/11 23:26:48 nat Exp $  */
 
 /*-
  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss%yahoo.com.au@localhost>
@@ -148,7 +148,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.338 2017/05/11 23:20:38 nat Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.339 2017/05/11 23:26:48 nat Exp $");
 
 #include "audio.h"
 #if NAUDIO > 0
@@ -3407,10 +3407,7 @@
 
        if (*offp < 0)
                return EINVAL;
-       if ((off_t)(*offp + len) < *offp) {
-               /* no offset wrapping */
-               return EOVERFLOW;
-       }
+
 #if 0
 /* XXX
  * The idea here was to use the protection to determine if
@@ -3435,7 +3432,7 @@
        cb = &vc->sc_mpr;
 #endif
 
-       if ((u_int)*offp >= cb->s.bufsize)
+       if (len > cb->s.bufsize || *offp > cb->s.bufsize - len)
                return EOVERFLOW;
 
        if (!cb->mmapped) {