diff options
| author | attilio <attilio@FreeBSD.org> | 2009-11-12 00:52:14 +0000 |
|---|---|---|
| committer | attilio <attilio@FreeBSD.org> | 2009-11-12 00:52:14 +0000 |
| commit | 4369e1fa0a7fa3b6fba2df3af213614064685f8d (patch) | |
| tree | 128437233ac9580060be5ff19683b8f84473bf73 /sys/kern/subr_bus.c | |
| parent | 01da2349df43dda915c9e7cdd794dff6385b3751 (diff) | |
| download | FreeBSD-src-4369e1fa0a7fa3b6fba2df3af213614064685f8d.zip FreeBSD-src-4369e1fa0a7fa3b6fba2df3af213614064685f8d.tar.gz | |
The building the dev nameunit string, in devclass_add_device() is based
on the assumption that the unit linked with the device is invariant but
that can change when calling devclass_alloc_unit() (because -1 is passed
or, more simply, because the unit choosen is beyond the table limits).
This results in a completely bogus string building.
Fix this by reserving the necessary room for all the possible characters
printable by a positive integer (we do not allow for negative unit
number).
Reported by: Sandvine Incorporated
Reviewed by: emaste
Sponsored by: Sandvine Incorporated
MFC: 1 week
Diffstat (limited to 'sys/kern/subr_bus.c')
| -rw-r--r-- | sys/kern/subr_bus.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c index 0e3ef80..eaec75b 100644 --- a/sys/kern/subr_bus.c +++ b/sys/kern/subr_bus.c @@ -35,6 +35,7 @@ __FBSDID("$FreeBSD$"); #include <sys/lock.h> #include <sys/kernel.h> #include <sys/kobj.h> +#include <sys/limits.h> #include <sys/malloc.h> #include <sys/module.h> #include <sys/mutex.h> @@ -1584,7 +1585,7 @@ devclass_add_device(devclass_t dc, device_t dev) PDEBUG(("%s in devclass %s", DEVICENAME(dev), DEVCLANAME(dc))); - buflen = snprintf(NULL, 0, "%s%d$", dc->name, dev->unit); + buflen = snprintf(NULL, 0, "%s%d$", dc->name, INT_MAX); if (buflen < 0) return (ENOMEM); dev->nameunit = malloc(buflen, M_BUS, M_NOWAIT|M_ZERO); |
