From 37230bf0c3710250e69cd660ed570534dd2557b7 Mon Sep 17 00:00:00 2001
From: Ilja van Sprundel <ivansprundel@ioactive.com>
Date: Sat, 5 Oct 2019 22:57:30 +0200
Subject: [PATCH] fix boundscheck

was checking upper bounds, but not lower bounds. This change fixes that.
---
 minix/kernel/system/do_safecopy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/minix/kernel/system/do_safecopy.c b/minix/kernel/system/do_safecopy.c
index eac8c0ebd..a76be4688 100644
--- a/minix/kernel/system/do_safecopy.c
+++ b/minix/kernel/system/do_safecopy.c
@@ -412,7 +412,7 @@ int do_vsafecopy(struct proc * caller, message * m_ptr)
 
 	/* No. of vector elements. */
 	els = m_ptr->m_lsys_kern_vsafecopy.vec_size;
-	if (els > SCPVEC_NR) {
+	if (els < 0 || els > SCPVEC_NR) {
 		return EINVAL;
 	}
 	bytes = els * sizeof(struct vscp_vec);