⬢ DragonFlyBSD Kernel Audit
DF-1435 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
diff --git a/sys/dev/disk/nata/atapi-cd.c b/sys/dev/disk/nata/atapi-cd.c
--- a/sys/dev/disk/nata/atapi-cd.c
+++ b/sys/dev/disk/nata/atapi-cd.c
@@ -1580,12 +1580,12 @@
 	break;
 
     case DVD_STRUCT_BCA:
-	s->length = ntohs(d->length);
+	s->length = imin(ntohs(d->length), sizeof(s->data));
 	bcopy(&d->data[0], &s->data[0], s->length);
 	break;
 
     case DVD_STRUCT_MANUFACT:
-	s->length = ntohs(d->length);
+	s->length = imin(ntohs(d->length), sizeof(s->data));
 	bcopy(&d->data[0], &s->data[0], s->length);
 	break;