⬢ DragonFlyBSD Kernel Audit
DF-3574 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/dev/disk/sym/sym_hipd.c b/sys/dev/disk/sym/sym_hipd.c
--- a/sys/dev/disk/sym/sym_hipd.c
+++ b/sys/dev/disk/sym/sym_hipd.c
@@ -8040,6 +8040,15 @@ static void sym_action2(struct cam_sim *sim, union ccb *ccb)
 	switch (ccb_h->func_code) {
 	case XPT_SET_TRAN_SETTINGS:
 	{
 		struct ccb_trans_settings *cts;
 
+		/*
+		 *  Minimal checkings, so that we will not
+		 *  go outside our tables.
+		 */
+		if (ccb_h->target_id   >= SYM_CONF_MAX_TARGET ||
+		    ccb_h->target_lun  >= SYM_CONF_MAX_LUN) {
+			sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE);
+			break;
+		}
 		cts  = &ccb->cts;
 		tp = &np->target[ccb_h->target_id];
 
@@ -8069,6 +8078,15 @@ static void sym_action2(struct cam_sim *sim, union ccb *ccb)
 	case XPT_GET_TRAN_SETTINGS:
 	{
 		struct ccb_trans_settings *cts;
 		struct sym_trans *tip;
 		u_char dflags;
 
+		/*
+		 *  Minimal checkings, so that we will not
+		 *  go outside our tables.
+		 */
+		if (ccb_h->target_id   >= SYM_CONF_MAX_TARGET ||
+		    ccb_h->target_lun  >= SYM_CONF_MAX_LUN) {
+			sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE);
+			break;
+		}
 		cts = &ccb->cts;
 		tp = &np->target[ccb_h->target_id];
 		lp = sym_lp(np, tp, ccb_h->target_lun);