⬢ DragonFlyBSD Kernel Audit
DF-1396 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
diff --git a/sys/dev/netif/oce/oce_mbox.c b/sys/dev/netif/oce/oce_mbox.c
--- a/sys/dev/netif/oce/oce_mbox.c
+++ b/sys/dev/netif/oce/oce_mbox.c
@@ -2012,12 +2012,16 @@
 
 	nic_desc = (struct oce_nic_resc_desc *) fwcmd->params.rsp.resources;
 	desc_count = HOST_32(fwcmd->params.rsp.desc_count);
+	if (desc_count > MAX_RESC_DESC)
+		desc_count = MAX_RESC_DESC;
 	for (i = 0; i < desc_count; i++) {
 		if ((nic_desc->desc_type == NIC_RESC_DESC_TYPE_V0) ||
 		    (nic_desc->desc_type == NIC_RESC_DESC_TYPE_V1)) {
 			nic_desc_valid = TRUE;
 			break;
 		}
+		if (nic_desc->desc_len < sizeof(struct oce_nic_resc_desc))
+			break;
 		nic_desc = (struct oce_nic_resc_desc *) \
 				((char *)nic_desc + nic_desc->desc_len);
 	}
@@ -2102,12 +2106,16 @@
 
 	nic_desc = (struct oce_nic_resc_desc *) fwcmd->params.rsp.resources;
 	desc_count = HOST_32(fwcmd->params.rsp.desc_count);
+	if (desc_count > MAX_RESC_DESC)
+		desc_count = MAX_RESC_DESC;
 	for (i = 0; i < desc_count; i++) {
 		if ((nic_desc->desc_type == NIC_RESC_DESC_TYPE_V0) ||
 		    (nic_desc->desc_type == NIC_RESC_DESC_TYPE_V1)) {
 			nic_desc_valid = TRUE;
 			break;
 		}
+		if (nic_desc->desc_len < sizeof(struct oce_nic_resc_desc))
+			break;
 		nic_desc = (struct oce_nic_resc_desc *) \
 				((char *)nic_desc + nic_desc->desc_len);
 	}