diff options
Diffstat (limited to 'sys/dev/pci/ubsec.c')
| -rw-r--r-- | sys/dev/pci/ubsec.c | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/sys/dev/pci/ubsec.c b/sys/dev/pci/ubsec.c index a1cbfc874b7..0e0cdd55947 100644 --- a/sys/dev/pci/ubsec.c +++ b/sys/dev/pci/ubsec.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ubsec.c,v 1.65 2001/07/02 04:34:47 jason Exp $ */ +/* $OpenBSD: ubsec.c,v 1.66 2001/07/04 06:03:55 jason Exp $ */ /* * Copyright (c) 2000 Jason L. Wright (jason@thought.net) @@ -803,6 +803,11 @@ ubsec_process(crp) err = ENOMEM; goto errout; } + if (q->q_src_l > 0xfffc) { + err = EIO; + goto errout; + } + q->q_mcr->mcr_pktlen = stheend; #ifdef UBSEC_DEBUG @@ -825,6 +830,11 @@ ubsec_process(crp) sskip = 0; } + if (q->q_src_packl[i] > 0xfffc) { + err = EIO; + goto errout; + } + if (j == 0) pb = &q->q_mcr->mcr_ipktbuf; else @@ -930,6 +940,15 @@ ubsec_process(crp) q->q_dst_l = iov2pages(q->q_dst_io, &q->q_dst_npa, q->q_dst_packp, q->q_dst_packl, UBS_MAX_SCATTER, NULL); + if (q->q_dst_l == 0) { + err = ENOMEM; + goto errout; + } + if (q->q_dst_l > 0xfffc) { + err = ENOMEM; + goto errout; + } + #ifdef UBSEC_DEBUG printf("dst skip: %d\n", dskip); #endif @@ -950,6 +969,11 @@ ubsec_process(crp) dskip = 0; } + if (q->q_dst_packl[i] > 0xfffc) { + err = EIO; + goto errout; + } + if (j == 0) pb = &q->q_mcr->mcr_opktbuf; else |