Merge pull request #1152 from GmEsoft/GmEsoft_Fix_devhd.c

EtchedPixels · web-flow · commit 433c6d130aca · 2025-02-05T10:40:45.000Z
Fixed potential out-of-bounds array access in Kernel/platform/platform-trs80/devhd.c
diff --git a/Kernel/platform/platform-trs80/devhd.c b/Kernel/platform/platform-trs80/devhd.c
@@ -167,7 +167,7 @@ int hd_open(uint8_t minor, uint16_t flag)
 {
 	uint8_t dev = minor >> 4;
 	flag;
-	if (dev > MAX_HD || parts[dev].g.head == 0 ||
+	if (dev >= MAX_HD || parts[dev].g.head == 0 ||
 		(minor && parts[dev].cyl[(minor-1)&0x0F] == 0xFFFF)) {
 		udata.u_error = ENODEV;
 		return -1;

Original file line number	Diff line number	Diff line change
`@@ -167,7 +167,7 @@ int hd_open(uint8_t minor, uint16_t flag)`
`167`	`167`	`{`
`168`	`168`	`uint8_t dev = minor >> 4;`
`169`	`169`	`flag;`
`170`		`- if (dev > MAX_HD \|\| parts[dev].g.head == 0 \|\|`
	`170`	`+ if (dev >= MAX_HD \|\| parts[dev].g.head == 0 \|\|`
`171`	`171`	`(minor && parts[dev].cyl[(minor-1)&0x0F] == 0xFFFF)) {`
`172`	`172`	`udata.u_error = ENODEV;`
`173`	`173`	`return -1;`