Module Name: src Committed By: snj Date: Sat Aug 12 04:28:39 UTC 2017
Modified Files: src/sys/dev/ic [netbsd-7-0]: ciss.c Log Message: Pull up following revision(s) (requested by mrg in ticket #1483): sys/dev/ic/ciss.c: revision 1.37 Reject negative indices from userland. To generate a diff of this commit: cvs rdiff -u -r1.32 -r1.32.8.1 src/sys/dev/ic/ciss.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/ic/ciss.c diff -u src/sys/dev/ic/ciss.c:1.32 src/sys/dev/ic/ciss.c:1.32.8.1 --- src/sys/dev/ic/ciss.c:1.32 Thu Oct 17 21:24:24 2013 +++ src/sys/dev/ic/ciss.c Sat Aug 12 04:28:39 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $ */ +/* $NetBSD: ciss.c,v 1.32.8.1 2017/08/12 04:28:39 snj Exp $ */ /* $OpenBSD: ciss.c,v 1.68 2013/05/30 16:15:02 deraadt Exp $ */ /* @@ -19,7 +19,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32.8.1 2017/08/12 04:28:39 snj Exp $"); #include "bio.h" @@ -1274,12 +1274,12 @@ ciss_ioctl(device_t dev, u_long cmd, voi /* FALLTHROUGH */ case BIOCDISK: bd = (struct bioc_disk *)addr; - if (bd->bd_volid > sc->maxunits) { + if (bd->bd_volid < 0 || bd->bd_volid > sc->maxunits) { error = EINVAL; break; } ldp = sc->sc_lds[0]; - if (!ldp || (pd = bd->bd_diskid) > ldp->ndrives) { + if (!ldp || (pd = bd->bd_diskid) < 0 || pd > ldp->ndrives) { error = EINVAL; break; } @@ -1380,7 +1380,7 @@ ciss_ioctl_vol(struct ciss_softc *sc, st int error = 0; u_int blks; - if (bv->bv_volid > sc->maxunits) { + if (bv->bv_volid < 0 || bv->bv_volid > sc->maxunits) { return EINVAL; } ldp = sc->sc_lds[bv->bv_volid];