[src/trunk]: src/sys/dev/ic Reject out-of-bounds channel index.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/b196d68e5add
branches:  trunk
changeset: 355398:b196d68e5add
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Jul 28 15:02:52 2017 +0000

description:
Reject out-of-bounds channel index.

>From Ilja Van Sprundel.

diffstat:

 sys/dev/ic/isp_netbsd.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 0ab99f036132 -r b196d68e5add sys/dev/ic/isp_netbsd.c
--- a/sys/dev/ic/isp_netbsd.c   Fri Jul 28 14:49:55 2017 +0000
+++ b/sys/dev/ic/isp_netbsd.c   Fri Jul 28 15:02:52 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.89 2017/07/28 15:02:52 riastradh Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@
                }
                lim = local.count;
                channel = local.channel;
+               if (channel >= isp->isp_nchan) {
+                       retval = EINVAL;
+                       break;
+               }
 
                ua = *(isp_dlist_t **)addr;
                uptr = &ua->wwns[0];