DragonFlyBSD Kernel Audit
DF-2521 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/trm/trm.c b/sys/dev/disk/trm/trm.c
--- a/sys/dev/disk/trm/trm.c
+++ b/sys/dev/disk/trm/trm.c
@@ -588,6 +588,14 @@
 	    		pccb->ccb_h.ccb_trmsrb_ptr = pSRB;
 	    		pccb->ccb_h.ccb_trmacb_ptr = pACB;
 		    	pSRB->pccb = pccb;
+			if (pcsio->cdb_len > sizeof(pSRB->CmdBlock)) {
+				pccb->ccb_h.status = CAM_REQ_INVALID;
+				pSRB->pNextSRB = pACB->pFreeSRB;
+				pACB->pFreeSRB = pSRB;
+				xpt_done(pccb);
+				crit_exit();
+				return;
+			}
 			pSRB->ScsiCmdLen = pcsio->cdb_len;
 			/* 
 			 * move layer of CAM command block to layer of SCSI