d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix possible out-of-bounds access detected by Ulrich Spörleins "scan-build".

Browse Source 
Some invalid PCI device selectors could cause read access to an initialized
variable next to the array (local loop index variable).

While here, the parser has been made more strict with regard to the syntax
of PCI device selectors as documented in the man-page. E.g. "pci:" used to
be interpreted as "pci0:0".

MFC after:	3 days
This commit is contained in:
Stefan Eßer 2016-02-19 14:01:35 +00:00
parent 64a3a6304e
commit a28a4d77b6
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=295806
1 changed files with 15 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
usr.sbin/pciconf/pciconf.c
View File

@ -897,7 +897,6 @@ static struct pcisel
parsesel(const char *str)
{
const char *ep;
const char *epbase;
char *eppos;
struct pcisel sel;
unsigned long selarr[4];
@ -909,30 +908,27 @@ parsesel(const char *str)
else
ep = str;
epbase = ep;
if (strncmp(ep, "pci", 3) == 0) {
ep += 3;
i = 0;
do {
while (isdigit(*ep) && i < 4) {
selarr[i++] = strtoul(ep, &eppos, 10);
ep = eppos;
} while ((*ep == ':' || *ep == '.') && *++ep != '\0' && i < 4);
if (i > 2)
sel.pc_func = selarr[--i];
else
sel.pc_func = 0;
sel.pc_dev = selarr[--i];
sel.pc_bus = selarr[--i];
if (i > 0)
sel.pc_domain = selarr[--i];
else
sel.pc_domain = 0;
if (*ep == ':') {
ep++;
if (*ep == '\0')
i = 0;
}
}
if (i > 0 && *ep == '\0') {
sel.pc_func = (i > 2) ? selarr[--i] : 0;
sel.pc_dev = (i > 0) ? selarr[--i] : 0;
sel.pc_bus = (i > 0) ? selarr[--i] : 0;
sel.pc_domain = (i > 0) ? selarr[--i] : 0;
return (sel);
}
}
if (*ep != '\x0' || ep == epbase)
errx(1, "cannot parse selector %s", str);
return sel;
errx(1, "cannot parse selector %s", str);
}
static struct pcisel