Plug two potential (root-only, local) information leaks. buf is not

initialized before use and returned integrally instead of up to size.

Submitted by:	Ilja van Sprundel <ilja -at- netric.org>
Reviewed by:	secteam
MFC after:	1 day

2 files changed, 8 insertions, 8 deletions

diff --git a/sys/dev/ipw/if_ipw.c b/sys/dev/ipw/if_ipw.c
index 2f16feb..8a69a40 100644
--- a/sys/dev/ipw/if_ipw.c
+++ b/sys/dev/ipw/if_ipw.c
@@ -2700,10 +2700,10 @@ ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
 	struct ipw_softc *sc = arg1;
 	uint32_t i, size, buf[256];
 
-	if (!(sc->flags & IPW_FLAG_FW_INITED)) {
-		memset(buf, 0, sizeof buf);
+	memset(buf, 0, sizeof buf);
+
+	if (!(sc->flags & IPW_FLAG_FW_INITED))
 		return SYSCTL_OUT(req, buf, sizeof buf);
-	}
 
 	CSR_WRITE_4(sc, IPW_CSR_AUTOINC_ADDR, sc->table1_base);
 
@@ -2711,7 +2711,7 @@ ipw_sysctl_stats(SYSCTL_HANDLER_ARGS)
 	for (i = 1; i < size; i++)
 		buf[i] = MEM_READ_4(sc, CSR_READ_4(sc, IPW_CSR_AUTOINC_DATA));
 
-	return SYSCTL_OUT(req, buf, sizeof buf);
+	return SYSCTL_OUT(req, buf, size);
 }
 
 static int
diff --git a/sys/dev/iwi/if_iwi.c b/sys/dev/iwi/if_iwi.c
index f4572d3..97dad68 100644
--- a/sys/dev/iwi/if_iwi.c
+++ b/sys/dev/iwi/if_iwi.c
@@ -3327,15 +3327,15 @@ iwi_sysctl_stats(SYSCTL_HANDLER_ARGS)
 	struct iwi_softc *sc = arg1;
 	uint32_t size, buf[128];
 
-	if (!(sc->flags & IWI_FLAG_FW_INITED)) {
-		memset(buf, 0, sizeof buf);
+	memset(buf, 0, sizeof buf);
+
+	if (!(sc->flags & IWI_FLAG_FW_INITED))
 		return SYSCTL_OUT(req, buf, sizeof buf);
-	}
 
 	size = min(CSR_READ_4(sc, IWI_CSR_TABLE0_SIZE), 128 - 1);
 	CSR_READ_REGION_4(sc, IWI_CSR_TABLE0_BASE, &buf[1], size);
 
-	return SYSCTL_OUT(req, buf, sizeof buf);
+	return SYSCTL_OUT(req, buf, size);
 }
 
 static int