diff options
author | kris <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
---|---|---|
committer | kris <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
commit | bd6f9cb9b63e7a70079067566e50b59abc81ce16 (patch) | |
tree | fd84e8d4d01cdc0f4ba330211093170c75b99172 /sys/dev | |
parent | 335f7eeb6361cc1f5a1fd9251b0f63ef3451f5ba (diff) | |
download | FreeBSD-src-bd6f9cb9b63e7a70079067566e50b59abc81ce16.zip FreeBSD-src-bd6f9cb9b63e7a70079067566e50b59abc81ce16.tar.gz |
Fix some signed/unsigned integer confusion, and add bounds checking of
arguments to some functions.
Obtained from: NetBSD
Reviewed by: peter
MFC after: 2 weeks
Diffstat (limited to 'sys/dev')
-rw-r--r-- | sys/dev/ccd/ccd.c | 3 | ||||
-rw-r--r-- | sys/dev/mlx/mlx.c | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/sys/dev/ccd/ccd.c b/sys/dev/ccd/ccd.c index 03f5a90..68df08e 100644 --- a/sys/dev/ccd/ccd.c +++ b/sys/dev/ccd/ccd.c @@ -1263,6 +1263,9 @@ ccdioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p) if ((error = ccdlock(cs)) != 0) return (error); + if (ccio->ccio_ndisks > CCD_MAXNDISKS) + return (EINVAL); + /* Fill in some important bits. */ cs->sc_ileave = ccio->ccio_ileave; if (cs->sc_ileave == 0 && diff --git a/sys/dev/mlx/mlx.c b/sys/dev/mlx/mlx.c index 189b787..b6ff7ea 100644 --- a/sys/dev/mlx/mlx.c +++ b/sys/dev/mlx/mlx.c @@ -1876,6 +1876,8 @@ mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu) /* if we need a buffer for data transfer, allocate one and copy in its initial contents */ if (mu->mu_datasize > 0) { + if (mu->mu_datasize > MAXPHYS) + return (EINVAL); if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) || (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize))) goto out; |