d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix parameter reversal potentially causing buffer overrun.

Browse Source 
Two arguments were reversed in calls to cam_strvis() in
nvme_da.c. This was found by a Coverity scan of this code within Dell
(Isilon). These are also marked in the FreeBSD Coverity scan as CIDs
1400526 & 1400531.

Submitted by:	robert.herndon@dell.com
Reviewed by:	vangyzen@, imp@
MFC after:	3 days
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D24117
This commit is contained in:
David Bright 2020-03-19 12:22:20 +00:00
parent 1b7ae4aa5e
commit 35c5ccf66d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/cam/nvme/nvme_da.c
View File

@ -815,9 +815,9 @@ ndaregister(struct cam_periph *periph, void *arg)
* the serial or model number strings. * the serial or model number strings.
*/ */
cam_strvis(disk->d_descr, cd->mn, cam_strvis(disk->d_descr, cd->mn,
sizeof(disk->d_descr), NVME_MODEL_NUMBER_LENGTH); NVME_MODEL_NUMBER_LENGTH, sizeof(disk->d_descr));
cam_strvis(disk->d_ident, cd->sn, cam_strvis(disk->d_ident, cd->sn,
sizeof(disk->d_ident), NVME_SERIAL_NUMBER_LENGTH); NVME_SERIAL_NUMBER_LENGTH, sizeof(disk->d_ident));
disk->d_hba_vendor = cpi.hba_vendor; disk->d_hba_vendor = cpi.hba_vendor;
disk->d_hba_device = cpi.hba_device; disk->d_hba_device = cpi.hba_device;
disk->d_hba_subvendor = cpi.hba_subvendor; disk->d_hba_subvendor = cpi.hba_subvendor;