Author: cem
Date: Wed Apr 20 01:17:18 2016
New Revision: 298322
URL: https://svnweb.freebsd.org/changeset/base/298322
Log:
nctgpio(4): Don't index past the end of sc->pins array
This driver thinks that the NCT_MAX_PIN index is a valid index in a few places
(nct_attach() for-loop, as well as NCT_IS_VALID_PIN()). Allocate room for
NCT_MAX_PIN as an index, that is, NCT_MAX_PIN + 1 elements.
Reported by: Coverity
CIDs: 1353806, 1353807, 1353808, 1353809, 1353810
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/dev/nctgpio/nctgpio.c
Modified: head/sys/dev/nctgpio/nctgpio.c
==============================================================================
--- head/sys/dev/nctgpio/nctgpio.c Wed Apr 20 01:10:07 2016
(r298321)
+++ head/sys/dev/nctgpio/nctgpio.c Wed Apr 20 01:17:18 2016
(r298322)
@@ -101,7 +101,7 @@ struct nct_softc {
struct mtx mtx;
struct resource *portres;
int rid;
- struct gpio_pin pins[NCT_MAX_PIN];
+ struct gpio_pin pins[NCT_MAX_PIN + 1];
};
#define GPIO_LOCK_INIT(_sc) mtx_init(&(_sc)->mtx, \
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
