diff options
| author | kris <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
|---|---|---|
| committer | kris <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
| commit | bd6f9cb9b63e7a70079067566e50b59abc81ce16 (patch) | |
| tree | fd84e8d4d01cdc0f4ba330211093170c75b99172 /sys/dev/mlx | |
| parent | 335f7eeb6361cc1f5a1fd9251b0f63ef3451f5ba (diff) | |
| download | FreeBSD-src-bd6f9cb9b63e7a70079067566e50b59abc81ce16.zip FreeBSD-src-bd6f9cb9b63e7a70079067566e50b59abc81ce16.tar.gz | |
Fix some signed/unsigned integer confusion, and add bounds checking of
arguments to some functions.
Obtained from: NetBSD
Reviewed by: peter
MFC after: 2 weeks
Diffstat (limited to 'sys/dev/mlx')
| -rw-r--r-- | sys/dev/mlx/mlx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/dev/mlx/mlx.c b/sys/dev/mlx/mlx.c index 189b787..b6ff7ea 100644 --- a/sys/dev/mlx/mlx.c +++ b/sys/dev/mlx/mlx.c @@ -1876,6 +1876,8 @@ mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu) /* if we need a buffer for data transfer, allocate one and copy in its initial contents */ if (mu->mu_datasize > 0) { + if (mu->mu_datasize > MAXPHYS) + return (EINVAL); if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) || (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize))) goto out; |
