[src/netbsd-7-1]: src/sys/dev/ic Pull up following revision(s) (requested by ...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7c45c3c08bc5
branches:  netbsd-7-1
changeset: 800775:7c45c3c08bc5
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Aug 12 04:23:19 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1482):
        sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.

diffstat:

 sys/dev/ic/isp_netbsd.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 4c5ec06bd6bc -r 7c45c3c08bc5 sys/dev/ic/isp_netbsd.c
--- a/sys/dev/ic/isp_netbsd.c   Sat Aug 12 04:16:52 2017 +0000
+++ b/sys/dev/ic/isp_netbsd.c   Sat Aug 12 04:23:19 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.86.20.1 2017/08/12 04:23:19 snj Exp $ */
 /*
  * Platform (NetBSD) dependent common attachment code for Qlogic adapters.
  */
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86.20.1 2017/08/12 04:23:19 snj Exp $");
 
 #include <dev/ic/isp_netbsd.h>
 #include <dev/ic/isp_ioctl.h>
@@ -475,6 +475,10 @@
                }
                lim = local.count;
                channel = local.channel;
+               if (channel >= isp->isp_nchan) {
+                       retval = EINVAL;
+                       break;
+               }
 
                ua = *(isp_dlist_t **)addr;
                uptr = &ua->wwns[0];