diff options
| author | mav <mav@FreeBSD.org> | 2014-10-06 12:40:15 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2014-10-06 12:40:15 +0000 |
| commit | 39e205854e81c55b2c0a0ae98ab334bab1d0945e (patch) | |
| tree | 2f4f5964b68b154c9439ef6a78db8889b13377ec | |
| parent | 401b622675b3199012dce74b7b567fd768b2d058 (diff) | |
| download | FreeBSD-src-39e205854e81c55b2c0a0ae98ab334bab1d0945e.zip FreeBSD-src-39e205854e81c55b2c0a0ae98ab334bab1d0945e.tar.gz | |
MFC r271354: Fix couple off-by-one range check errors, reported by Coverity.
| -rw-r--r-- | sys/cam/ctl/ctl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c index 4ede434..54509d4 100644 --- a/sys/cam/ctl/ctl.c +++ b/sys/cam/ctl/ctl.c @@ -2545,7 +2545,7 @@ ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag, mtx_lock(&softc->ctl_lock); if (((ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) == 0) - && ((ooa_hdr->lun_num > CTL_MAX_LUNS) + && ((ooa_hdr->lun_num >= CTL_MAX_LUNS) || (softc->ctl_luns[ooa_hdr->lun_num] == NULL))) { mtx_unlock(&softc->ctl_lock); free(entries, M_CTL); @@ -2740,7 +2740,7 @@ ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag, #ifdef CTL_IO_DELAY mtx_lock(&softc->ctl_lock); - if ((delay_info->lun_id > CTL_MAX_LUNS) + if ((delay_info->lun_id >= CTL_MAX_LUNS) || (softc->ctl_luns[delay_info->lun_id] == NULL)) { delay_info->status = CTL_DELAY_STATUS_INVALID_LUN; } else { |
