DragonFlyBSD Kernel Audit
DF-1291 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/mly/mly.c b/sys/dev/raid/mly/mly.c
--- a/sys/dev/raid/mly/mly.c
+++ b/sys/dev/raid/mly/mly.c
@@ -2921,13 +2921,13 @@
     /* return the sense buffer to userspace */
     if ((uc->RequestSenseLength > 0) && (mc->mc_sense > 0)) {
 	if ((error = copyout(mc->mc_packet, uc->RequestSenseBuffer, 
-			     min(uc->RequestSenseLength, mc->mc_sense))) != 0)
+			     min(uc->RequestSenseLength, min(mc->mc_sense, sizeof(mc->mc_packet))))) != 0)
 	    goto out;
     }
     
     /* return command results to userspace (caller will copy out) */
     uc->DataTransferLength = mc->mc_resid;
-    uc->RequestSenseLength = min(uc->RequestSenseLength, mc->mc_sense);
+    uc->RequestSenseLength = min(uc->RequestSenseLength, min(mc->mc_sense, sizeof(mc->mc_packet)));
     uc->CommandStatus = mc->mc_status;
     error = 0;