⬢ DragonFlyBSD Kernel Audit
DF-2505 / fix_combined.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
--- a/sys/dev/disk/nata/atapi-cd.c	2026-10-15 23:32:04.877306882 +0000
+++ b/sys/dev/disk/nata/atapi-cd.c	2026-10-15 23:32:19.813116281 +0000
@@ -721,6 +721,10 @@
 	break;
 
     case CDRIOCSETBLOCKSIZE:
+	if (*(int *)ap->a_data <= 0) {
+	    error = EINVAL;
+	    break;
+	}
 	cdp->block_size = *(int *)ap->a_data;
 	acd_set_ioparm(dev);
 	break;
@@ -1579,15 +1583,29 @@
 	bcopy(&d->data[0], &s->data[0], 2048);
 	break;
 
-    case DVD_STRUCT_BCA:
-	s->length = ntohs(d->length);
-	bcopy(&d->data[0], &s->data[0], s->length);
+    case DVD_STRUCT_BCA: {
+	u_int32_t copylen = ntohs(d->length);
+
+	if (copylen > length - 4)
+	    copylen = length - 4;
+	if (copylen > sizeof(s->data))
+	    copylen = sizeof(s->data);
+	s->length = copylen;
+	bcopy(&d->data[0], &s->data[0], copylen);
 	break;
+    }
 
-    case DVD_STRUCT_MANUFACT:
-	s->length = ntohs(d->length);
-	bcopy(&d->data[0], &s->data[0], s->length);
+    case DVD_STRUCT_MANUFACT: {
+	u_int32_t copylen = ntohs(d->length);
+
+	if (copylen > length - 4)
+	    copylen = length - 4;
+	if (copylen > sizeof(s->data))
+	    copylen = sizeof(s->data);
+	s->length = copylen;
+	bcopy(&d->data[0], &s->data[0], copylen);
 	break;
+    }
 		
     default:
 	error = EINVAL;