⬢ DragonFlyBSD Kernel Audit
DF-2613 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
diff --git a/sys/bus/cam/scsi/scsi_ses.c b/sys/bus/cam/scsi/scsi_ses.c
index fe53967..815f7e5 100644
--- a/sys/bus/cam/scsi/scsi_ses.c
+++ b/sys/bus/cam/scsi/scsi_ses.c
@@ -1309,11 +1309,11 @@ ses_enchdr(uint8_t *buffer, int amt, uint8_t SubEncId, SesEncHdr *chp)
 {
 	int s, off = 8;
 	for (s = 0; s < SubEncId; s++) {
-		if (off + 3 > amt)
+		if (off + 4 > amt)
 			return (-1);
 		off += buffer[off+3] + 4;
 	}
-	if (off + 3 > amt) {
+	if (off + 4 > amt) {
 		return (-1);
 	}
 	gget8(buffer, off+1, chp->Subencid);
@@ -1327,11 +1327,11 @@ ses_encdesc(uint8_t *buffer, int amt, uint8_t SubEncId, SesEncDesc *cdp)
 {
 	int s, e, enclen, off = 8;
 	for (s = 0; s < SubEncId; s++) {
-		if (off + 3 > amt)
+		if (off + 4 > amt)
 			return (-1);
 		off += buffer[off+3] + 4;
 	}
-	if (off + 3 > amt) {
+	if (off + 4 > amt) {
 		return (-1);
 	}
 	gget8(buffer, off+3, enclen);
@@ -1356,11 +1356,11 @@ ses_getthdr(uint8_t *buffer, int amt, int nth, SesThdr *thp)
 		return (-1);
 	}
 	for (s = 0; s < buffer[1]; s++) {
-		if (off + 3 > amt)
+		if (off + 4 > amt)
 			return (-1);
 		off += buffer[off+3] + 4;
 	}
-	if (off + 3 > amt) {
+	if (off + 4 > amt) {
 		return (-1);
 	}
 	off += buffer[off+3] + 4 + (nth * 4);