6a79d5f419
The hpt{nr,rr} ioctl handler allocates a buffer without M_ZERO and calls
hpt_do_ioctl(), which might not overwrite the entire buffer.
Also zero bytesReturned in case it is not written by hpt_do_ioctl().
The hpt27{nr,rr} device has permissions only for root so this is not urgent,
and the fix can be MFCd and considered for a future EN.
The same issue was reported in the hpt27xx driver by Ilja Van Sprundel.
Reviewed by: jhb, kib
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
|
||
|---|---|---|
| .. | ||
| amd64-elf.hptrr_lib.o.uu | ||
| array.h | ||
| him.h | ||
| himfuncs.h | ||
| hptintf.h | ||
| hptrr_config.c | ||
| hptrr_config.h | ||
| hptrr_os_bsd.c | ||
| hptrr_osm_bsd.c | ||
| i386-elf.hptrr_lib.o.uu | ||
| ldm.h | ||
| list.h | ||
| os_bsd.h | ||
| osm.h | ||