⬢ DragonFlyBSD Kernel Audit
DF-1357 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
diff --git a/sys/dev/raid/amr/amr.c b/sys/dev/raid/amr/amr.c
--- a/sys/dev/raid/amr/amr.c
+++ b/sys/dev/raid/amr/amr.c
@@ -621,7 +621,12 @@
 	        if (error)
 		    break;
 	    }
-	    error = copyout(ap->ap_request_sense_area, ((struct amr_passthrough *)(uintptr_t)mb->mb_physaddr)->ap_request_sense_area, ap->ap_request_sense_length);
+	    {
+		u_int8_t sense_len = ap->ap_request_sense_length;
+		if (sense_len > AMR_MAX_REQ_SENSE_LEN)
+			sense_len = AMR_MAX_REQ_SENSE_LEN;
+		error = copyout(ap->ap_request_sense_area, ((struct amr_passthrough *)(uintptr_t)mb->mb_physaddr)->ap_request_sense_area, sense_len);
+	    }
 	    if (error)
 		break;