DragonFlyBSD Kernel Audit
DF-1501 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/misc/musycc/musycc.c
+++ b/sys/dev/misc/musycc/musycc.c
@@ -1492,6 +1492,11 @@
 		return(ENXIO);
 	}
 	csc->nchan = (u >> 8) & 0xf;
+	if (csc->nchan < 1 || csc->nchan > NPORT) {
+		kprintf("LMC1504 reports implausible nchan=%d (max %d)\n",
+		    csc->nchan, NPORT);
+		return (ENXIO);
+	}
 	kprintf("Found <LanMedia LMC1504 Rev %d Chan %d>\n", (u >> 12) & 0xf, csc->nchan);
 
 	csc->creg = 0xfe;