From cc6ab3189125beb510a0cda836cce2648b8fede5 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Sun, 12 Oct 2014 20:18:59 +0200
Subject: pc: sanity check bda value in lowraminit() to avoid overflow with efi

---
 sys/src/9/pc/memory.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sys/src/9/pc/memory.c b/sys/src/9/pc/memory.c
index 8f634c107..851f1b1d7 100644
--- a/sys/src/9/pc/memory.c
+++ b/sys/src/9/pc/memory.c
@@ -376,7 +376,7 @@ sigsearch(char* signature)
 static void
 lowraminit(void)
 {
-	ulong n, pa, x;
+	ulong pa, x;
 	uchar *bda;
 
 	/*
@@ -387,9 +387,11 @@ lowraminit(void)
 	 */
 	x = PADDR(CPU0END);
 	bda = (uchar*)KADDR(0x400);
-	n = ((bda[0x14]<<8)|bda[0x13])*KB-x;
-	mapfree(&rmapram, x, n);
-	memset(KADDR(x), 0, n);			/* keep us honest */
+	pa = ((bda[0x14]<<8)|bda[0x13])*KB;
+	if(x < pa){
+		mapfree(&rmapram, x, pa-x);
+		memset(KADDR(x), 0, pa-x);		/* keep us honest */
+	}
 
 	x = PADDR(PGROUND((ulong)end));
 	pa = MemMin;
-- 
cgit v1.2.3