diff --git a/sys/dev/disk/sym/sym_hipd.c b/sys/dev/disk/sym/sym_hipd.c --- a/sys/dev/disk/sym/sym_hipd.c +++ b/sys/dev/disk/sym/sym_hipd.c @@ -8040,6 +8040,15 @@ static void sym_action2(struct cam_sim *sim, union ccb *ccb) switch (ccb_h->func_code) { case XPT_SET_TRAN_SETTINGS: { struct ccb_trans_settings *cts; + /* + * Minimal checkings, so that we will not + * go outside our tables. + */ + if (ccb_h->target_id >= SYM_CONF_MAX_TARGET || + ccb_h->target_lun >= SYM_CONF_MAX_LUN) { + sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE); + break; + } cts = &ccb->cts; tp = &np->target[ccb_h->target_id]; @@ -8069,6 +8078,15 @@ static void sym_action2(struct cam_sim *sim, union ccb *ccb) case XPT_GET_TRAN_SETTINGS: { struct ccb_trans_settings *cts; struct sym_trans *tip; u_char dflags; + /* + * Minimal checkings, so that we will not + * go outside our tables. + */ + if (ccb_h->target_id >= SYM_CONF_MAX_TARGET || + ccb_h->target_lun >= SYM_CONF_MAX_LUN) { + sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE); + break; + } cts = &ccb->cts; tp = &np->target[ccb_h->target_id]; lp = sym_lp(np, tp, ccb_h->target_lun);