diff options
| author | ngie <ngie@FreeBSD.org> | 2016-05-13 09:05:29 +0000 |
|---|---|---|
| committer | ngie <ngie@FreeBSD.org> | 2016-05-13 09:05:29 +0000 |
| commit | d9fb3da6318f636778a4f7284001324326ca5abd (patch) | |
| tree | b733ea61274e1b76516dbe938af154b19fb2a922 /sys/dev/ciss/ciss.c | |
| parent | 98e5307b424d86f0e874f73834d19a75f3ef0ad8 (diff) | |
| download | FreeBSD-src-d9fb3da6318f636778a4f7284001324326ca5abd.zip FreeBSD-src-d9fb3da6318f636778a4f7284001324326ca5abd.tar.gz | |
MFC r298670:
r298670 (by cem):
ciss(4): Fix overrun of array
The softc member 'ciss_logical' is an array of 'ciss_max_logical_bus' members.
Most of the time it is iterated correctly. This patch fixes the two instances
where the driver iterated off the end of the array.
CID: 1305492
Diffstat (limited to 'sys/dev/ciss/ciss.c')
| -rw-r--r-- | sys/dev/ciss/ciss.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ciss/ciss.c b/sys/dev/ciss/ciss.c index a465fac..00a4e77 100644 --- a/sys/dev/ciss/ciss.c +++ b/sys/dev/ciss/ciss.c @@ -1431,7 +1431,7 @@ ciss_init_logical(struct ciss_softc *sc) goto out; } - for (i = 0; i <= sc->ciss_max_logical_bus; i++) { + for (i = 0; i < sc->ciss_max_logical_bus; i++) { sc->ciss_logical[i] = malloc(sc->ciss_cfg->max_logical_supported * sizeof(struct ciss_ldrive), @@ -2030,7 +2030,7 @@ ciss_free(struct ciss_softc *sc) if (sc->ciss_parent_dmat) bus_dma_tag_destroy(sc->ciss_parent_dmat); if (sc->ciss_logical) { - for (i = 0; i <= sc->ciss_max_logical_bus; i++) { + for (i = 0; i < sc->ciss_max_logical_bus; i++) { for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) { if (sc->ciss_logical[i][j].cl_ldrive) free(sc->ciss_logical[i][j].cl_ldrive, CISS_MALLOC_CLASS); |
