DragonFlyBSD Kernel Audit
DF-2520 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/trm/trm.c b/sys/dev/disk/trm/trm.c
--- a/sys/dev/disk/trm/trm.c
+++ b/sys/dev/disk/trm/trm.c
@@ -422,6 +422,13 @@
 	pSRB = (PSRB)arg;
 	ccb = pSRB->pccb;
 	pACB = (PACB)ccb->ccb_h.ccb_trmacb_ptr;
+
+	if (nseg > TRM_MAX_SG_LISTENTRY) {
+		ccb->ccb_h.status = CAM_REQ_TOO_BIG;
+		xpt_done(ccb);
+		crit_exit();
+		return;
+	}
 	TRM_DPRINTF("trm_ExecuteSRB..........\n");        
 	if (nseg != 0) {
 		PSEG			psg;