DF-2521 / fix.diff
diff --git a/sys/dev/disk/trm/trm.c b/sys/dev/disk/trm/trm.c --- a/sys/dev/disk/trm/trm.c +++ b/sys/dev/disk/trm/trm.c @@ -588,6 +588,14 @@ pccb->ccb_h.ccb_trmsrb_ptr = pSRB; pccb->ccb_h.ccb_trmacb_ptr = pACB; pSRB->pccb = pccb; + if (pcsio->cdb_len > sizeof(pSRB->CmdBlock)) { + pccb->ccb_h.status = CAM_REQ_INVALID; + pSRB->pNextSRB = pACB->pFreeSRB; + pACB->pFreeSRB = pSRB; + xpt_done(pccb); + crit_exit(); + return; + } pSRB->ScsiCmdLen = pcsio->cdb_len; /* * move layer of CAM command block to layer of SCSI |