Add tests for segment lengths and total lengths bigger than the chip can handle.

Also, add a missing test for *2pages failure on destination buffers.

1 files changed, 25 insertions, 1 deletions

diff --git a/sys/dev/pci/ubsec.c b/sys/dev/pci/ubsec.c
index a1cbfc874b7..0e0cdd55947 100644
--- a/sys/dev/pci/ubsec.c
+++ b/sys/dev/pci/ubsec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ubsec.c,v 1.65 2001/07/02 04:34:47 jason Exp $	*/
+/*	$OpenBSD: ubsec.c,v 1.66 2001/07/04 06:03:55 jason Exp $	*/
 
 /*
  * Copyright (c) 2000 Jason L. Wright (jason@thought.net)
@@ -803,6 +803,11 @@ ubsec_process(crp)
 		err = ENOMEM;
 		goto errout;
 	}
+	if (q->q_src_l > 0xfffc) {
+		err = EIO;
+		goto errout;
+	}
+
 	q->q_mcr->mcr_pktlen = stheend;
 
 #ifdef UBSEC_DEBUG
@@ -825,6 +830,11 @@ ubsec_process(crp)
 			sskip = 0;
 		}
 
+		if (q->q_src_packl[i] > 0xfffc) {
+			err = EIO;
+			goto errout;
+		}
+
 		if (j == 0)
 			pb = &q->q_mcr->mcr_ipktbuf;
 		else
@@ -930,6 +940,15 @@ ubsec_process(crp)
 			q->q_dst_l = iov2pages(q->q_dst_io, &q->q_dst_npa,
 			    q->q_dst_packp, q->q_dst_packl, UBS_MAX_SCATTER, NULL);
 
+		if (q->q_dst_l == 0) {
+			err = ENOMEM;
+			goto errout;
+		}
+		if (q->q_dst_l > 0xfffc) {
+			err = ENOMEM;
+			goto errout;
+		}
+
 #ifdef UBSEC_DEBUG
 		printf("dst skip: %d\n", dskip);
 #endif
@@ -950,6 +969,11 @@ ubsec_process(crp)
 				dskip = 0;
 			}
 
+			if (q->q_dst_packl[i] > 0xfffc) {
+				err = EIO;
+				goto errout;
+			}
+
 			if (j == 0)
 				pb = &q->q_mcr->mcr_opktbuf;
 			else