[Bug 209545] Heap overflows in an driver

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209545

--- Comment #2 from commit-hook at freebsd.org ---
A commit references this bug:

Author: sbruno
Date: Tue May 24 13:57:24 UTC 2016
New revision: 300612
URL: https://svnweb.freebsd.org/changeset/base/300612

Log:
  Reject ioctl commands for FLSHGCHR and FLSHPCHR if the size is greater
  than sc->areq.  This is a bounds check to ensure we're not just cramming
  arbitrarily sized nonsense into the driver and overflowing the heap.

  PR:           209545
  Submitted by: cturt at hardenedbsd.org
  MFC after:    2 weeks

Changes:
  head/sys/dev/an/if_an.c

-- 
You are receiving this mail because:
You are the assignee for the bug.