[src/netbsd-7]: src/sys/dev/ic Pull up following revision(s) (requested by mr...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/146831bf4930
branches:  netbsd-7
changeset: 800299:146831bf4930
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Aug 12 04:23:41 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1482):
        sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.

diffstat:

 sys/dev/ic/isp_netbsd.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r a6ab8042f2bd -r 146831bf4930 sys/dev/ic/isp_netbsd.c
--- a/sys/dev/ic/isp_netbsd.c   Sat Aug 12 04:18:09 2017 +0000
+++ b/sys/dev/ic/isp_netbsd.c   Sat Aug 12 04:23:41 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.86.14.1 2017/08/12 04:23:41 snj Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86.14.1 2017/08/12 04:23:41 snj Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@
                }
                lim = local.count;
                channel = local.channel;
+               if (channel >= isp->isp_nchan) {
+                       retval = EINVAL;
+                       break;
+               }
 
                ua = *(isp_dlist_t **)addr;
                uptr = &ua->wwns[0];