DragonFlyBSD Kernel Audit
DF-1230 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/mpr/mpr.c b/sys/dev/raid/mpr/mpr.c
--- a/sys/dev/raid/mpr/mpr.c
+++ b/sys/dev/raid/mpr/mpr.c
@@ -2391,9 +2391,7 @@
 					    MPI2_IOCSTATUS_MASK) ==
 					    MPI2_IOCSTATUS_DIAGNOSTIC_RELEASED)
 					{
-						pBuffer =
-						    &sc->fw_diag_buffer_list[
-						    rel_rep->BufferType];
+						if (rel_rep->BufferType < 3) pBuffer = &sc->fw_diag_buffer_list[rel_rep->BufferType]; else break;
 						pBuffer->valid_data = TRUE;
 						pBuffer->owned_by_firmware =
 						    FALSE;
@@ -2457,7 +2455,7 @@
 
 	event = le16toh(reply->Event);
 	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
-		if (isset(eh->mask, event)) {
+		if (event < (int)(sizeof(eh->mask) * NBBY) && isset(eh->mask, event)) {
 			eh->callback(sc, data, reply);
 			handled++;
 		}