diff options
| author | cem <cem@FreeBSD.org> | 2016-04-26 22:01:07 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2016-04-26 22:01:07 +0000 |
| commit | cfbeb94fb2b947fabf788f145d3df7c5f9f928a0 (patch) | |
| tree | 942b1f93a0577843bf3ed10cd4ac91edac6cd820 /sys/dev | |
| parent | c8822142748632918f0eee1fd03f70dee8027cbb (diff) | |
| download | FreeBSD-src-cfbeb94fb2b947fabf788f145d3df7c5f9f928a0.zip FreeBSD-src-cfbeb94fb2b947fabf788f145d3df7c5f9f928a0.tar.gz | |
ciss(4): Fix overrun of array
The softc member 'ciss_logical' is an array of 'ciss_max_logical_bus' members.
Most of the time it is iterated correctly. This patch fixes the two instances
where the driver iterated off the end of the array.
Reported by: Coverity
CID: 1305492
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/ciss/ciss.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ciss/ciss.c b/sys/dev/ciss/ciss.c index 974bf50..6c2a843 100644 --- a/sys/dev/ciss/ciss.c +++ b/sys/dev/ciss/ciss.c @@ -1431,7 +1431,7 @@ ciss_init_logical(struct ciss_softc *sc) goto out; } - for (i = 0; i <= sc->ciss_max_logical_bus; i++) { + for (i = 0; i < sc->ciss_max_logical_bus; i++) { sc->ciss_logical[i] = malloc(sc->ciss_cfg->max_logical_supported * sizeof(struct ciss_ldrive), @@ -2030,7 +2030,7 @@ ciss_free(struct ciss_softc *sc) if (sc->ciss_parent_dmat) bus_dma_tag_destroy(sc->ciss_parent_dmat); if (sc->ciss_logical) { - for (i = 0; i <= sc->ciss_max_logical_bus; i++) { + for (i = 0; i < sc->ciss_max_logical_bus; i++) { for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) { if (sc->ciss_logical[i][j].cl_ldrive) free(sc->ciss_logical[i][j].cl_ldrive, CISS_MALLOC_CLASS); |
