[src/netbsd-7]: src/doc tickets 1734, 1735

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/087a97c6c484
branches:  netbsd-7
changeset: 934693:087a97c6c484
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Tue Jun 16 10:36:03 2020 +0000

description:
tickets 1734, 1735

diffstat:

 doc/CHANGES-7.3 |  15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletions(-)

diffs (26 lines):

diff -r e28f23361a29 -r 087a97c6c484 doc/CHANGES-7.3
--- a/doc/CHANGES-7.3   Tue Jun 16 10:34:49 2020 +0000
+++ b/doc/CHANGES-7.3   Tue Jun 16 10:36:03 2020 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-7.3,v 1.1.2.85 2020/06/07 16:46:01 martin Exp $
+# $NetBSD: CHANGES-7.3,v 1.1.2.86 2020/06/16 10:36:03 bouyer Exp $
 
 A complete list of changes from the NetBSD 7.2 release to the NetBSD 7.3
 release:
@@ -867,3 +867,16 @@
        Do not queue sysmon refresh until the rndsource is attached.
        [riastradh, ticket #1733]
 
+sys/dev/usb/if_otus.c                          1.45 via patch
+
+       Stricter bounds check for some packet length we get from the usb chip,
+       to make sure we do not corrupt kernel memory.
+       Pointed out by Ilja Van Sprundel.
+       [martin, ticket #1734]
+
+sys/dev/usb/if_run.c                           1.41
+
+       Better bounds checking for oversized packets, to avoid kernel memory
+       corruption. Pointed out by Ilja Van Sprundel.
+       [martin, ticket #1735]
+