⬢ DragonFlyBSD Kernel Audit
DF-1426 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
diff --git a/sys/dev/raid/iir/iir.c b/sys/dev/raid/iir/iir.c
--- a/sys/dev/raid/iir/iir.c
+++ b/sys/dev/raid/iir/iir.c
@@ -416,7 +416,10 @@
             else {
                 drv_hds = gdt->sc_info2 & 0xff;
                 drv_secs = (gdt->sc_info2 >> 8) & 0xff;
-                drv_cyls = gdt->sc_hdr[i].hd_size / drv_hds /
+			if (drv_hds == 0 || drv_secs == 0) {
+				drv_hds = drv_secs = 1;
+			}
+			drv_cyls = gdt->sc_hdr[i].hd_size / drv_hds /
                     drv_secs;
             }
             gdt->sc_hdr[i].hd_heads = drv_hds;
@@ -1721,7 +1724,7 @@
         if (msg_len)
             if (!(gccb->gc_scratch[GDT_SCR_MSG_ANSWER] &&
                   gccb->gc_scratch[GDT_SCR_MSG_EXT])) {
-                gccb->gc_scratch[GDT_SCR_MSG_TEXT + msg_len] = '\0';
+			gccb->gc_scratch[GDT_SCR_MSG_TEXT + imin(msg_len, (u_int32_t)(GDT_SCRATCH_SZ - GDT_SCR_MSG_TEXT - 1))] = '\0';
                 kprintf("%s",&gccb->gc_scratch[GDT_SCR_MSG_TEXT]);
             }