d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix undefined behavior when using asmc_fan_getstring()

Browse Source 
It was returning a pointer to stack-allocated memory, so make the
allocation at the caller instead.

Found by:	clang static analyzer
Coverity:	CID 1245774
Reviewed by:	ed, rpaulo
Review URL:	https://reviews.freebsd.org/D4740
This commit is contained in:
Ulrich Spörlein 2016-01-05 10:25:22 +00:00
parent 076daeda4f
commit 623534d683
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/dev/asmc/asmc.c
View File

@ -963,14 +963,13 @@ asmc_fan_getvalue(device_t dev, const char *key, int fan)
}
static char*
asmc_fan_getstring(device_t dev, const char *key, int fan)
asmc_fan_getstring(device_t dev, const char *key, int fan, uint8_t *buf, uint8_t buflen)
{
uint8_t buf[16];
char fankey[5];
char* desc;
snprintf(fankey, sizeof(fankey), key, fan);
if (asmc_key_read(dev, fankey, buf, sizeof buf) < 0)
if (asmc_key_read(dev, fankey, buf, buflen) < 0)
return (NULL);
desc = buf+4;
@ -1012,12 +1011,13 @@ asmc_mb_sysctl_fanspeed(SYSCTL_HANDLER_ARGS)
static int
asmc_mb_sysctl_fanid(SYSCTL_HANDLER_ARGS)
{
uint8_t buf[16];
device_t dev = (device_t) arg1;
int fan = arg2;
int error = true;
char* desc;
desc = asmc_fan_getstring(dev, ASMC_KEY_FANID, fan);
desc = asmc_fan_getstring(dev, ASMC_KEY_FANID, fan, buf, sizeof(buf));
if (desc != NULL)
error = sysctl_handle_string(oidp, desc, 0, req);