diff --git a/sys/dev/raid/mly/mly.c b/sys/dev/raid/mly/mly.c --- a/sys/dev/raid/mly/mly.c +++ b/sys/dev/raid/mly/mly.c @@ -2921,13 +2921,13 @@ /* return the sense buffer to userspace */ if ((uc->RequestSenseLength > 0) && (mc->mc_sense > 0)) { if ((error = copyout(mc->mc_packet, uc->RequestSenseBuffer, - min(uc->RequestSenseLength, mc->mc_sense))) != 0) + min(uc->RequestSenseLength, min(mc->mc_sense, sizeof(mc->mc_packet))))) != 0) goto out; } /* return command results to userspace (caller will copy out) */ uc->DataTransferLength = mc->mc_resid; - uc->RequestSenseLength = min(uc->RequestSenseLength, mc->mc_sense); + uc->RequestSenseLength = min(uc->RequestSenseLength, min(mc->mc_sense, sizeof(mc->mc_packet))); uc->CommandStatus = mc->mc_status; error = 0;