⬢ DragonFlyBSD Kernel Audit
DF-3817 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/mpr/mpr.c
+++ b/sys/dev/raid/mpr/mpr.c
@@ -2062,8 +2062,14 @@
 	case MPI2_EVENT_LOG_DATA:
 		mpr_dprint(sc, MPR_EVENT, "MPI2_EVENT_LOG_DATA:\n");
 		if (sc->mpr_debug & MPR_EVENT)
-			hexdump(event->EventData, event->EventDataLength, NULL,
-			    0);
+			/* EventDataLength counts 32-bit words and is
+			 * device-supplied; clamp to the bytes actually
+			 * present in the reply frame. */
+			hexdump(event->EventData,
+			    imin(le16toh(event->EventDataLength) * 4,
+			    sc->replyframesz - offsetof(
+			    MPI2_EVENT_NOTIFICATION_REPLY, EventData)),
+			    NULL, 0);
 		break;
 	case MPI2_EVENT_LOG_ENTRY_ADDED:
 		entry = (MPI2_EVENT_DATA_LOG_ENTRY_ADDED *)event->EventData;