DragonFlyBSD Kernel Audit
DF-1161 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/mpt/mpt_cam.c b/sys/dev/disk/mpt/mpt_cam.c
--- a/sys/dev/disk/mpt/mpt_cam.c
+++ b/sys/dev/disk/mpt/mpt_cam.c
@@ -2949,6 +2949,11 @@
 	}
 
 	ioindex = le32toh(rp->TransactionContext);
+	if (ioindex >= mpt->els_cmds_allocated) {
+		mpt_prt(mpt, "ELS_REPLY: ioindex %u >= els_cmds_allocated %u\n",
+		    ioindex, mpt->els_cmds_allocated);
+		return (TRUE);
+	}
 	req = mpt->els_cmd_ptrs[ioindex];
 
 	if (rctl == ELS && type == 1) {