[Bug 209545] Heap overflows in an driver

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209545

--- Comment #3 from commit-hook at freebsd.org ---
A commit references this bug:

Author: sbruno
Date: Fri Jul 22 03:26:02 UTC 2016
New revision: 303177
URL: https://svnweb.freebsd.org/changeset/base/303177

Log:
  MFC r300612
  Reject ioctl commands for FLSHGCHR and FLSHPCHR if the size is greater
  than sc->areq.  This is a bounds check to ensure we're not just cramming
  arbitrarily sized nonsense into the driver and overflowing the heap.

  PR:           209545

Changes:
  stable/10/sys/dev/an/if_an.c

-- 
You are receiving this mail because:
You are the assignee for the bug.