diff options
| author | Adrian Chadd <adrian@FreeBSD.org> | 2015-09-26 07:14:00 +0000 |
|---|---|---|
| committer | Adrian Chadd <adrian@FreeBSD.org> | 2015-09-26 07:14:00 +0000 |
| commit | 436ed6b50dba29dd8171f69610fc888807bb2f16 (patch) | |
| tree | 1f67da414623b31457481b0c49669e29aff0d567 /sys/dev/otus | |
| parent | 20aff35e6b893449116c680ef9ebeddc666c5676 (diff) | |
Notes
Diffstat (limited to 'sys/dev/otus')
| -rw-r--r-- | sys/dev/otus/if_otus.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/sys/dev/otus/if_otus.c b/sys/dev/otus/if_otus.c index 6d080927b1ee..9e34294e922c 100644 --- a/sys/dev/otus/if_otus.c +++ b/sys/dev/otus/if_otus.c @@ -1292,6 +1292,14 @@ otus_cmd(struct otus_softc *sc, uint8_t code, const void *idata, int ilen, /* Always bulk-out a multiple of 4 bytes. */ xferlen = (sizeof (*hdr) + ilen + 3) & ~3; + if (xferlen > OTUS_MAX_TXCMDSZ) { + device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n", + __func__, + code, + xferlen, + OTUS_MAX_TXCMDSZ); + return (EIO); + } cmd = otus_get_txcmd(sc); if (cmd == NULL) { @@ -1346,7 +1354,7 @@ otus_write(struct otus_softc *sc, uint32_t reg, uint32_t val) sc->write_buf[sc->write_idx].reg = htole32(reg); sc->write_buf[sc->write_idx].val = htole32(val); - if (++sc->write_idx > AR_MAX_WRITE_IDX) + if (++sc->write_idx > (AR_MAX_WRITE_IDX-1)) (void)otus_write_barrier(sc); } |