Reject out-of-bounds channel index.
From Ilja Van Sprundel.
This commit is contained in:
parent
8c4d14f179
commit
930eafe842
@ -1,4 +1,4 @@
|
||||
/* $NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $ */
|
||||
/* $NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $ */
|
||||
/*
|
||||
* Platform (NetBSD) dependent common attachment code for Qlogic adapters.
|
||||
*/
|
||||
@ -33,7 +33,7 @@
|
||||
*/
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $");
|
||||
__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $");
|
||||
|
||||
#include <dev/ic/isp_netbsd.h>
|
||||
#include <dev/ic/isp_ioctl.h>
|
||||
@ -475,6 +475,10 @@ ispioctl(struct scsipi_channel *chan, u_long cmd, void *addr, int flag,
|
||||
}
|
||||
lim = local.count;
|
||||
channel = local.channel;
|
||||
if (channel >= isp->isp_nchan) {
|
||||
retval = EINVAL;
|
||||
break;
|
||||
}
|
||||
|
||||
ua = *(isp_dlist_t **)addr;
|
||||
uptr = &ua->wwns[0];
|
||||
|
Loading…
Reference in New Issue
Block a user