diff options
| author | loos <loos@FreeBSD.org> | 2014-06-27 18:40:14 +0000 |
|---|---|---|
| committer | loos <loos@FreeBSD.org> | 2014-06-27 18:40:14 +0000 |
| commit | 1a2b2b9314fc0df5cd44b6fd583c4225e16f35b3 (patch) | |
| tree | 1ce9ee0f4802e41829762da8e22f120a8f5c2273 /usr.sbin/bsnmpd | |
| parent | 089bdcccb84b407c9ffb65262d674c447b029649 (diff) | |
| download | FreeBSD-src-1a2b2b9314fc0df5cd44b6fd583c4225e16f35b3.zip FreeBSD-src-1a2b2b9314fc0df5cd44b6fd583c4225e16f35b3.tar.gz | |
Correct the buffer length check to avoid overflows.
Found with: Coverity Scan
CID: 1222502, 1222503
Diffstat (limited to 'usr.sbin/bsnmpd')
| -rw-r--r-- | usr.sbin/bsnmpd/modules/snmp_lm75/snmp_lm75.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/usr.sbin/bsnmpd/modules/snmp_lm75/snmp_lm75.c b/usr.sbin/bsnmpd/modules/snmp_lm75/snmp_lm75.c index 386dc5f..7935d97 100644 --- a/usr.sbin/bsnmpd/modules/snmp_lm75/snmp_lm75.c +++ b/usr.sbin/bsnmpd/modules/snmp_lm75/snmp_lm75.c @@ -140,7 +140,7 @@ sysctlname(int *oid, int nlen, char *name, size_t len) { int mib[12]; - if (nlen > (int)sizeof(mib) + 2) + if (nlen > (int)(sizeof(mib) / sizeof(int) - 2)) return (-1); mib[0] = 0; @@ -158,7 +158,7 @@ sysctlgetnext(int *oid, int nlen, int *next, size_t *nextlen) { int mib[12]; - if (nlen > (int)sizeof(mib) + 2) + if (nlen > (int)(sizeof(mib) / sizeof(int) - 2)) return (-1); mib[0] = 0; @@ -180,10 +180,13 @@ update_sensor_sysctl(char *obuf, size_t *obuflen, int idx, const char *name) /* Fill out the mib information. */ snprintf(buf, sizeof(buf) - 1, "dev.lm75.%d.%s", idx, name); - len = 4; + len = sizeof(mib) / sizeof(int); if (sysctlnametomib(buf, mib, &len) == -1) return (-1); + if (len != 4) + return (-1); + /* Read the sysctl data. */ if (sysctl(mib, len, obuf, obuflen, NULL, 0) == -1) return (-1); |
