DF-1229 / fix.diff
diff --git a/sys/dev/raid/mpr/mpr.c b/sys/dev/raid/mpr/mpr.c --- a/sys/dev/raid/mpr/mpr.c +++ b/sys/dev/raid/mpr/mpr.c @@ -2391,9 +2391,7 @@ MPI2_IOCSTATUS_MASK) == MPI2_IOCSTATUS_DIAGNOSTIC_RELEASED) { - pBuffer = - &sc->fw_diag_buffer_list[ - rel_rep->BufferType]; + if (rel_rep->BufferType < 3) pBuffer = &sc->fw_diag_buffer_list[rel_rep->BufferType]; else break; pBuffer->valid_data = TRUE; pBuffer->owned_by_firmware = FALSE; @@ -2457,7 +2455,7 @@ event = le16toh(reply->Event); TAILQ_FOREACH(eh, &sc->event_list, eh_list) { - if (isset(eh->mask, event)) { + if (event < (int)(sizeof(eh->mask) * NBBY) && isset(eh->mask, event)) { eh->callback(sc, data, reply); handled++; } |