d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ciss(4): Fix overrun of array

Browse Source 
The softc member 'ciss_logical' is an array of 'ciss_max_logical_bus' members.
Most of the time it is iterated correctly.  This patch fixes the two instances
where the driver iterated off the end of the array.

Reported by:	Coverity
CID:		1305492
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-04-26 22:01:07 +00:00
parent 90b9cca2a8
commit 5eae46af9c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/dev/ciss/ciss.c
View File

@ -1431,7 +1431,7 @@ ciss_init_logical(struct ciss_softc *sc)
goto out;
}
for (i = 0; i <= sc->ciss_max_logical_bus; i++) {
for (i = 0; i < sc->ciss_max_logical_bus; i++) {
sc->ciss_logical[i] =
malloc(sc->ciss_cfg->max_logical_supported *
sizeof(struct ciss_ldrive),
@ -2030,7 +2030,7 @@ ciss_free(struct ciss_softc *sc)
if (sc->ciss_parent_dmat)
bus_dma_tag_destroy(sc->ciss_parent_dmat);
if (sc->ciss_logical) {
for (i = 0; i <= sc->ciss_max_logical_bus; i++) {
for (i = 0; i < sc->ciss_max_logical_bus; i++) {
for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) {
if (sc->ciss_logical[i][j].cl_ldrive)
free(sc->ciss_logical[i][j].cl_ldrive, CISS_MALLOC_CLASS);