CVS commit: [netbsd-7-1] src/sys/dev/ic

[Soren Jacobsen]

Module Name:    src
Committed By:   snj
Date:           Sat Aug 12 04:23:19 UTC 2017

Modified Files:
        src/sys/dev/ic [netbsd-7-1]: isp_netbsd.c

Log Message:
Pull up following revision(s) (requested by mrg in ticket #1482):
        sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.86 -r1.86.20.1 src/sys/dev/ic/isp_netbsd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/ic/isp_netbsd.c
diff -u src/sys/dev/ic/isp_netbsd.c:1.86 src/sys/dev/ic/isp_netbsd.c:1.86.20.1
--- src/sys/dev/ic/isp_netbsd.c:1.86	Tue Aug 21 15:53:07 2012
+++ src/sys/dev/ic/isp_netbsd.c	Sat Aug 12 04:23:19 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.86.20.1 2017/08/12 04:23:19 snj Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86.20.1 2017/08/12 04:23:19 snj Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@ ispioctl(struct scsipi_channel *chan, u_
 		}
 		lim = local.count;
 		channel = local.channel;
+		if (channel >= isp->isp_nchan) {
+			retval = EINVAL;
+			break;
+		}
 
 		ua = *(isp_dlist_t **)addr;
 		uptr = &ua->wwns[0];