[src/netbsd-7-1]: src/sys/dev/ic Pull up following revision(s) (requested by ...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6bcd3434a896
branches:  netbsd-7-1
changeset: 800776:6bcd3434a896
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Aug 12 04:28:55 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1483):
        sys/dev/ic/ciss.c: revision 1.37
Reject negative indices from userland.

diffstat:

 sys/dev/ic/ciss.c |  10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diffs (42 lines):

diff -r 7c45c3c08bc5 -r 6bcd3434a896 sys/dev/ic/ciss.c
--- a/sys/dev/ic/ciss.c Sat Aug 12 04:23:19 2017 +0000
+++ b/sys/dev/ic/ciss.c Sat Aug 12 04:28:55 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $       */
+/*     $NetBSD: ciss.c,v 1.32.12.1 2017/08/12 04:28:55 snj Exp $       */
 /*     $OpenBSD: ciss.c,v 1.68 2013/05/30 16:15:02 deraadt Exp $       */
 
 /*
@@ -19,7 +19,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32.12.1 2017/08/12 04:28:55 snj Exp $");
 
 #include "bio.h"
 
@@ -1274,12 +1274,12 @@
                /* FALLTHROUGH */
        case BIOCDISK:
                bd = (struct bioc_disk *)addr;
-               if (bd->bd_volid > sc->maxunits) {
+               if (bd->bd_volid < 0 || bd->bd_volid > sc->maxunits) {
                        error = EINVAL;
                        break;
                }
                ldp = sc->sc_lds[0];
-               if (!ldp || (pd = bd->bd_diskid) > ldp->ndrives) {
+               if (!ldp || (pd = bd->bd_diskid) < 0 || pd > ldp->ndrives) {
                        error = EINVAL;
                        break;
                }
@@ -1380,7 +1380,7 @@
        int error = 0;
        u_int blks;
 
-       if (bv->bv_volid > sc->maxunits) {
+       if (bv->bv_volid < 0 || bv->bv_volid > sc->maxunits) {
                return EINVAL;
        }
        ldp = sc->sc_lds[bv->bv_volid];