2 files changed, 5 insertions, 0 deletions

diff --git a/sys/dev/ccd/ccd.c b/sys/dev/ccd/ccd.c
index 03f5a903243b..68df08e12d17 100644
--- a/sys/dev/ccd/ccd.c
+++ b/sys/dev/ccd/ccd.c
@@ -1263,6 +1263,9 @@ ccdioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 		if ((error = ccdlock(cs)) != 0)
 			return (error);
 
+		if (ccio->ccio_ndisks > CCD_MAXNDISKS)
+			return (EINVAL);
+ 
 		/* Fill in some important bits. */
 		cs->sc_ileave = ccio->ccio_ileave;
 		if (cs->sc_ileave == 0 &&
diff --git a/sys/dev/mlx/mlx.c b/sys/dev/mlx/mlx.c
index 189b7879f05e..b6ff7ea86b7c 100644
--- a/sys/dev/mlx/mlx.c
+++ b/sys/dev/mlx/mlx.c
@@ -1876,6 +1876,8 @@ mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
 
     /* if we need a buffer for data transfer, allocate one and copy in its initial contents */
     if (mu->mu_datasize > 0) {
+	if (mu->mu_datasize > MAXPHYS)
+	    return (EINVAL);
 	if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
 	    (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize)))
 	    goto out;