[src/netbsd-9]: src/doc Tickets #957 & #958.

[jdc <jdc%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9970b16ea3d7
branches:  netbsd-9
changeset: 1001810:9970b16ea3d7
user:      jdc <jdc%NetBSD.org@localhost>
date:      Thu Jun 11 11:04:11 2020 +0000

description:
Tickets #957 & #958.

diffstat:

 doc/CHANGES-9.1 |  15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletions(-)

diffs (26 lines):

diff -r 218d7c28a3a6 -r 9970b16ea3d7 doc/CHANGES-9.1
--- a/doc/CHANGES-9.1   Thu Jun 11 11:03:22 2020 +0000
+++ b/doc/CHANGES-9.1   Thu Jun 11 11:04:11 2020 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-9.1,v 1.1.2.64 2020/06/07 19:08:12 martin Exp $
+# $NetBSD: CHANGES-9.1,v 1.1.2.65 2020/06/11 11:04:11 jdc Exp $
 
 A complete list of changes from the NetBSD 9.0 release to the NetBSD 9.1
 release:
@@ -2886,3 +2886,16 @@
        _ARCH_ARM_6 has a split of 2:2 and others have a split of 3:1.
        [skrll, ticket #951]
 
+src/sys/dev/usb/if_otus.c                      1.45 (via patch)
+
+       Stricter bounds check for some packet length we get from the usb chip,
+       to make sure we do not corrupt kernel memory.
+       Pointed out by Ilja Van Sprundel.
+       [martin, ticket #957]
+
+src/sys/dev/usb/if_run.c                       1.41
+
+       Better bounds checking for oversized packets, to avoid kernel memory
+       corruption. Pointed out by Ilja Van Sprundel.
+       [martin, ticket #958]
+