[src/netbsd-6-0]: src/sys/dev/ic Pull up following revision(s) (requested by ...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/29911def53d1
branches:  netbsd-6-0
changeset: 775249:29911def53d1
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Aug 19 04:27:35 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1485):
        sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.

diffstat:

 sys/dev/ic/isp_netbsd.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 6bb2ff3427a8 -r 29911def53d1 sys/dev/ic/isp_netbsd.c
--- a/sys/dev/ic/isp_netbsd.c   Sat Aug 19 04:24:20 2017 +0000
+++ b/sys/dev/ic/isp_netbsd.c   Sat Aug 19 04:27:35 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.85.2.1 2012/09/03 18:38:34 riz Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.85.2.1.2.1 2017/08/19 04:27:35 snj Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.85.2.1 2012/09/03 18:38:34 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.85.2.1.2.1 2017/08/19 04:27:35 snj Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@
                }
                lim = local.count;
                channel = local.channel;
+               if (channel >= isp->isp_nchan) {
+                       retval = EINVAL;
+                       break;
+               }
 
                ua = *(isp_dlist_t **)addr;
                uptr = &ua->wwns[0];