DragonFlyBSD Kernel Audit
DF-1664 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/twa/tw_cl_misc.c b/sys/dev/raid/twa/tw_cl_misc.c
--- a/sys/dev/raid/twa/tw_cl_misc.c
+++ b/sys/dev/raid/twa/tw_cl_misc.c
@@ -530,14 +530,18 @@
 	event->retrieved = TW_CL_AEN_NOT_RETRIEVED;
 
 	__va_start(ap, event_specific_desc);
-	tw_osl_vsprintf(event->parameter_data, event_specific_desc, ap);
+	kvsnprintf(event->parameter_data, sizeof(event->parameter_data),
+		event_specific_desc, ap);
 	__va_end(ap);
 
 	event->parameter_len =
 		(TW_UINT8)(tw_osl_strlen(event->parameter_data));
-	tw_osl_strcpy(event->parameter_data + event->parameter_len + 1,
-		event_desc);
-	event->parameter_len += (1 + tw_osl_strlen(event_desc));
+	if (event->parameter_len + 1 + tw_osl_strlen(event_desc) <
+		sizeof(event->parameter_data)) {
+		tw_osl_strcpy(event->parameter_data + event->parameter_len + 1,
+			event_desc);
+		event->parameter_len += (1 + tw_osl_strlen(event_desc));
+	}
 
 	tw_cli_dbg_printf(4, ctlr_handle, tw_osl_cur_func(),
 		"event = %x %x %x %x %x %x %x\n %s",