diff options
author | Kris Kennaway <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
---|---|---|
committer | Kris Kennaway <kris@FreeBSD.org> | 2001-09-10 11:28:07 +0000 |
commit | bf61e266962ca1823db8cad0e512ca69a3480a0c (patch) | |
tree | fd84e8d4d01cdc0f4ba330211093170c75b99172 /sys/dev/mlx | |
parent | 746b3df68f1f8030b49d60c080ab92fac77c270f (diff) | |
download | src-bf61e266962ca1823db8cad0e512ca69a3480a0c.tar.gz src-bf61e266962ca1823db8cad0e512ca69a3480a0c.zip |
Fix some signed/unsigned integer confusion, and add bounds checking of
arguments to some functions.
Obtained from: NetBSD
Reviewed by: peter
MFC after: 2 weeks
Notes
Notes:
svn path=/head/; revision=83291
Diffstat (limited to 'sys/dev/mlx')
-rw-r--r-- | sys/dev/mlx/mlx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/dev/mlx/mlx.c b/sys/dev/mlx/mlx.c index 189b7879f05e..b6ff7ea86b7c 100644 --- a/sys/dev/mlx/mlx.c +++ b/sys/dev/mlx/mlx.c @@ -1876,6 +1876,8 @@ mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu) /* if we need a buffer for data transfer, allocate one and copy in its initial contents */ if (mu->mu_datasize > 0) { + if (mu->mu_datasize > MAXPHYS) + return (EINVAL); if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) || (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize))) goto out; |