706bba66ba
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)". Check overrun first. This change fixes a bug that iop(4) panics while attaching iopsp(4). |
||
---|---|---|
.. | ||
dpti.c | ||
dptivar.h | ||
files.i2o | ||
i2o.h | ||
i2odpt.h | ||
iop.c | ||
iopio.h | ||
iopreg.h | ||
iopsp.c | ||
iopspvar.h | ||
iopvar.h | ||
ld_iop.c | ||
Makefile |