diff options
| author | Jonathan Matthew <jmatthew@cvs.openbsd.org> | 2015-09-11 10:19:06 +0000 |
|---|---|---|
| committer | Jonathan Matthew <jmatthew@cvs.openbsd.org> | 2015-09-11 10:19:06 +0000 |
| commit | 154142f236814a3d6b642b5e34f82992ce9fea37 (patch) | |
| tree | 8fea2927f5ffd92adbed45d2879a875fbc879ebc /sys | |
| parent | afc7f8e91512fa8addf325f8c7c073856de4aa32 (diff) | |
Don't copy more sense data than we have space for, so we don't crash when
trying to talk to a Sun STK6140. Still doesn't work though.
ok dlg@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/pci/qle.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/dev/pci/qle.c b/sys/dev/pci/qle.c index e6b8eb0b4b0..ea9032422cd 100644 --- a/sys/dev/pci/qle.c +++ b/sys/dev/pci/qle.c @@ -1,4 +1,4 @@ -/* $OpenBSD: qle.c,v 1.37 2015/09/06 04:54:44 deraadt Exp $ */ +/* $OpenBSD: qle.c,v 1.38 2015/09/11 10:19:05 jmatthew Exp $ */ /* * Copyright (c) 2013, 2014 Jonathan Matthew <jmatthew@openbsd.org> @@ -1101,8 +1101,9 @@ qle_handle_resp(struct qle_softc *sc, u_int32_t id) int sr; data = status->data + lemtoh32(&status->fcp_rsp_len); - memcpy(&xs->sense, data, - lemtoh32(&status->fcp_sense_len)); + sr = MIN(lemtoh32(&status->fcp_sense_len), + sizeof(xs->sense)); + memcpy(&xs->sense, data, sr); xs->error = XS_SENSE; pp = (u_int32_t *)&xs->sense; for (sr = 0; sr < sizeof(xs->sense)/4; sr++) { |