Module Name: src
Committed By: riastradh
Date: Fri Jul 28 15:02:52 UTC 2017
Modified Files:
src/sys/dev/ic: isp_netbsd.c
Log Message:
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.88 -r1.89 src/sys/dev/ic/isp_netbsd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/isp_netbsd.c
diff -u src/sys/dev/ic/isp_netbsd.c:1.88 src/sys/dev/ic/isp_netbsd.c:1.89
--- src/sys/dev/ic/isp_netbsd.c:1.88 Wed Dec 31 17:10:45 2014
+++ src/sys/dev/ic/isp_netbsd.c Fri Jul 28 15:02:52 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $ */
/*
* Platform (NetBSD) dependent common attachment code for Qlogic adapters.
*/
@@ -33,7 +33,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $");
#include <dev/ic/isp_netbsd.h>
#include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@ ispioctl(struct scsipi_channel *chan, u_
}
lim = local.count;
channel = local.channel;
+ if (channel >= isp->isp_nchan) {
+ retval = EINVAL;
+ break;
+ }
ua = *(isp_dlist_t **)addr;
uptr = &ua->wwns[0];
