⬢ DragonFlyBSD Kernel Audit
DF-1739 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
diff --git a/sys/dev/raid/vinum/vinumioctl.c b/sys/dev/raid/vinum/vinumioctl.c
--- a/sys/dev/raid/vinum/vinumioctl.c
+++ b/sys/dev/raid/vinum/vinumioctl.c
@@ -381,7 +381,7 @@
 struct drive *
 validdrive(int driveno, struct _ioctl_reply *reply)
 {
-    if ((driveno < vinum_conf.drives_allocated)
+    if ((driveno >= 0) && (driveno < vinum_conf.drives_allocated)
 	&& (DRIVE[driveno].state > drive_referenced))
 	return &DRIVE[driveno];
     strcpy(reply->msg, "No such drive");
@@ -392,7 +392,7 @@
 struct sd *
 validsd(int sdno, struct _ioctl_reply *reply)
 {
-    if ((sdno < vinum_conf.subdisks_allocated)
+    if ((sdno >= 0) && (sdno < vinum_conf.subdisks_allocated)
 	&& (SD[sdno].state > sd_referenced))
 	return &SD[sdno];
     strcpy(reply->msg, "No such subdisk");
@@ -403,7 +403,7 @@
 struct plex *
 validplex(int plexno, struct _ioctl_reply *reply)
 {
-    if ((plexno < vinum_conf.plexes_allocated)
+    if ((plexno >= 0) && (plexno < vinum_conf.plexes_allocated)
 	&& (PLEX[plexno].state > plex_referenced))
 	return &PLEX[plexno];
     strcpy(reply->msg, "No such plex");
@@ -414,7 +414,7 @@
 struct volume *
 validvol(int volno, struct _ioctl_reply *reply)
 {
-    if ((volno < vinum_conf.volumes_allocated)
+    if ((volno >= 0) && (volno < vinum_conf.volumes_allocated)
 	&& (VOL[volno].state > volume_uninit))
 	return &VOL[volno];
     strcpy(reply->msg, "No such volume");
@@ -430,7 +430,7 @@
 
     switch (msg->type) {
     case drive_object:
-	if (msg->index < vinum_conf.drives_allocated) {
+	if (msg->index >= 0 && msg->index < vinum_conf.drives_allocated) {
 	    struct drive *drive = &DRIVE[msg->index];
 	    if (drive->state > drive_referenced) {
 		drive->reads = 0;			    /* number of reads on this drive */
@@ -444,7 +444,7 @@
 	    return;
 	}
     case sd_object:
-	if (msg->index < vinum_conf.subdisks_allocated) {
+	if (msg->index >= 0 && msg->index < vinum_conf.subdisks_allocated) {
 	    struct sd *sd = &SD[msg->index];
 	    if (sd->state > sd_referenced) {
 		sd->reads = 0;				    /* number of reads on this subdisk */
@@ -460,7 +460,7 @@
 	break;
 
     case plex_object:
-	if (msg->index < vinum_conf.plexes_allocated) {
+	if (msg->index >= 0 && msg->index < vinum_conf.plexes_allocated) {
 	    struct plex *plex = &PLEX[msg->index];
 	    if (plex->state > plex_referenced) {
 		plex->reads = 0;