[src/netbsd-8]: src/sys/dev/ic Pull up following revision(s) (requested by sp...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ca3973f7c28c
branches:  netbsd-8
changeset: 434197:ca3973f7c28c
user:      snj <snj%NetBSD.org@localhost>
date:      Wed Aug 09 05:17:03 2017 +0000

description:
Pull up following revision(s) (requested by spz in ticket #195):
        sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.

diffstat:

 sys/dev/ic/isp_netbsd.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 7ab66cfa4375 -r ca3973f7c28c sys/dev/ic/isp_netbsd.c
--- a/sys/dev/ic/isp_netbsd.c   Wed Aug 09 05:14:20 2017 +0000
+++ b/sys/dev/ic/isp_netbsd.c   Wed Aug 09 05:17:03 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.88.10.1 2017/08/09 05:17:03 snj Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.88 2014/12/31 17:10:45 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.88.10.1 2017/08/09 05:17:03 snj Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@
                }
                lim = local.count;
                channel = local.channel;
+               if (channel >= isp->isp_nchan) {
+                       retval = EINVAL;
+                       break;
+               }
 
                ua = *(isp_dlist_t **)addr;
                uptr = &ua->wwns[0];