[src/trunk]: src/sys/dev/spi More input validation. Fix off-by-1 for size limit.

[mlelstv <mlelstv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9dcb40a90bf8
branches:  trunk
changeset: 997471:9dcb40a90bf8
user:      mlelstv <mlelstv%NetBSD.org@localhost>
date:      Sat Mar 09 07:53:12 2019 +0000

description:
More input validation. Fix off-by-1 for size limit.

diffstat:

 sys/dev/spi/spi.c |  13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diffs (40 lines):

diff -r 9d662987ecce -r 9dcb40a90bf8 sys/dev/spi/spi.c
--- a/sys/dev/spi/spi.c Sat Mar 09 06:12:55 2019 +0000
+++ b/sys/dev/spi/spi.c Sat Mar 09 07:53:12 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: spi.c,v 1.10 2019/02/23 10:43:25 mlelstv Exp $ */
+/* $NetBSD: spi.c,v 1.11 2019/03/09 07:53:12 mlelstv Exp $ */
 
 /*-
  * Copyright (c) 2006 Urbana-Champaign Independent Media Center.
@@ -42,7 +42,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: spi.c,v 1.10 2019/02/23 10:43:25 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: spi.c,v 1.11 2019/03/09 07:53:12 mlelstv Exp $");
 
 #include "locators.h"
 
@@ -250,14 +250,19 @@
                        error = EINVAL;
                        break;
                }
+               if ((sit->sit_send && sit->sit_sendlen == 0)
+                   || (sit->sit_recv && sit->sit_recv == 0)) {
+                       error = EINVAL;
+                       break;
+               }
                sh = &sc->sc_slaves[sit->sit_addr];
                sbuf = rbuf = NULL;
                error = 0;
-               if (sit->sit_send && sit->sit_sendlen < SPI_MAXDATA) {
+               if (sit->sit_send && sit->sit_sendlen <= SPI_MAXDATA) {
                        sbuf = malloc(sit->sit_sendlen, M_DEVBUF, M_WAITOK);
                        error = copyin(sit->sit_send, sbuf, sit->sit_sendlen);
                }
-               if (sit->sit_recv && sit->sit_recvlen < SPI_MAXDATA) {
+               if (sit->sit_recv && sit->sit_recvlen <= SPI_MAXDATA) {
                        rbuf = malloc(sit->sit_recvlen, M_DEVBUF, M_WAITOK);
                }
                if (error == 0) {