DF-1933 / fix.diff
diff --git a/sys/dev/disk/dm/striped/dm_target_striped.c b/sys/dev/disk/dm/striped/dm_target_striped.c --- a/sys/dev/disk/dm/striped/dm_target_striped.c +++ b/sys/dev/disk/dm/striped/dm_target_striped.c @@ -212,6 +212,7 @@ ret = ksnprintf(ptr, len, "%d %jd", tsc->stripe_num, (intmax_t)tsc->stripe_chunksize); + if (ret < 0 || (size_t)ret >= len) goto trunc; ptr += ret; len -= ret; @@ -219,10 +220,12 @@ ret = ksnprintf(ptr, len, " %s %jd", tsc->stripe_devs[i].pdev->udev_name, (intmax_t)tsc->stripe_devs[i].offset); + if (ret < 0 || (size_t)ret >= len) goto trunc; ptr += ret; len -= ret; } +trunc: return params; } |