diff options
| author | Jason Wright <jason@cvs.openbsd.org> | 2001-07-04 06:03:56 +0000 |
|---|---|---|
| committer | Jason Wright <jason@cvs.openbsd.org> | 2001-07-04 06:03:56 +0000 |
| commit | 4d355b33fa579a2ea2bce9275b63fc6ec13b09ee (patch) | |
| tree | 332a3b22d771462e15c0bcc800d83cf9bb1f2072 | |
| parent | 96ba4775547c552e9cd98f44fcd65d08f25ac385 (diff) | |
Add tests for segment lengths and total lengths bigger than the chip can handle.
Also, add a missing test for *2pages failure on destination buffers.
| -rw-r--r-- | sys/dev/pci/ubsec.c | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/sys/dev/pci/ubsec.c b/sys/dev/pci/ubsec.c index a1cbfc874b7..0e0cdd55947 100644 --- a/sys/dev/pci/ubsec.c +++ b/sys/dev/pci/ubsec.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ubsec.c,v 1.65 2001/07/02 04:34:47 jason Exp $ */ +/* $OpenBSD: ubsec.c,v 1.66 2001/07/04 06:03:55 jason Exp $ */ /* * Copyright (c) 2000 Jason L. Wright (jason@thought.net) @@ -803,6 +803,11 @@ ubsec_process(crp) err = ENOMEM; goto errout; } + if (q->q_src_l > 0xfffc) { + err = EIO; + goto errout; + } + q->q_mcr->mcr_pktlen = stheend; #ifdef UBSEC_DEBUG @@ -825,6 +830,11 @@ ubsec_process(crp) sskip = 0; } + if (q->q_src_packl[i] > 0xfffc) { + err = EIO; + goto errout; + } + if (j == 0) pb = &q->q_mcr->mcr_ipktbuf; else @@ -930,6 +940,15 @@ ubsec_process(crp) q->q_dst_l = iov2pages(q->q_dst_io, &q->q_dst_npa, q->q_dst_packp, q->q_dst_packl, UBS_MAX_SCATTER, NULL); + if (q->q_dst_l == 0) { + err = ENOMEM; + goto errout; + } + if (q->q_dst_l > 0xfffc) { + err = ENOMEM; + goto errout; + } + #ifdef UBSEC_DEBUG printf("dst skip: %d\n", dskip); #endif @@ -950,6 +969,11 @@ ubsec_process(crp) dskip = 0; } + if (q->q_dst_packl[i] > 0xfffc) { + err = EIO; + goto errout; + } + if (j == 0) pb = &q->q_mcr->mcr_opktbuf; else |