⬢ DragonFlyBSD Kernel Audit
DF-1424 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
diff --git a/sys/dev/raid/iir/iir.c b/sys/dev/raid/iir/iir.c
--- a/sys/dev/raid/iir/iir.c
+++ b/sys/dev/raid/iir/iir.c
@@ -1611,19 +1611,23 @@
             if (ucmd->service == GDT_CACHESERVICE) {
                 if (ucmd->OpCode == GDT_IOCTL) {
                     cnt = ucmd->u.ioctl.param_size;
+                    if (cnt > GDT_SCRATCH_SZ)
+                        cnt = GDT_SCRATCH_SZ;
                     if (cnt != 0)
                         bcopy(gccb->gc_scratch, ucmd->data, cnt);
                 } else {
                     cnt = ucmd->u.cache.BlockCnt * GDT_SECTOR_SIZE;
+                    if (cnt > GDT_SCRATCH_SZ)
+                        cnt = GDT_SCRATCH_SZ;
                     if (cnt != 0)
                         bcopy(gccb->gc_scratch, ucmd->data, cnt);
                 }
             } else {
                 cnt = ucmd->u.raw.sdlen;
+                if (cnt > GDT_SCRATCH_SZ)
+                    cnt = GDT_SCRATCH_SZ;
                 if (cnt != 0)
                     bcopy(gccb->gc_scratch, ucmd->data, cnt);
-                if (ucmd->u.raw.sense_len != 0)
-                    bcopy(gccb->gc_scratch, ucmd->data, cnt);
             }
             gdt_free_ccb(gdt, gccb);
             if (!(gdt->sc_state & GDT_POLLING))