From owner-freebsd-wireless@freebsd.org  Tue Dec 15 17:55:41 2015
Return-Path: <owner-freebsd-wireless@freebsd.org>
Delivered-To: freebsd-wireless@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id EAB55A48D0F
 for <freebsd-wireless@mailman.ysv.freebsd.org>;
 Tue, 15 Dec 2015 17:55:41 +0000 (UTC)
 (envelope-from s3erios@gmail.com)
Received: from mail-lf0-x232.google.com (mail-lf0-x232.google.com
 [IPv6:2a00:1450:4010:c07::232])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 91BE51798;
 Tue, 15 Dec 2015 17:55:41 +0000 (UTC)
 (envelope-from s3erios@gmail.com)
Received: by mail-lf0-x232.google.com with SMTP id z124so7644733lfa.3;
 Tue, 15 Dec 2015 09:55:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=content-type:to:subject:references:date:mime-version
 :content-transfer-encoding:from:message-id:in-reply-to:user-agent;
 bh=z9dAOOEKuOgrjpAGBbCQ8TkVMz4Tb+W8M4LJ3gx9kY8=;
 b=jnINbTAy6SCqQtUo1cFRdnoMU/4yQTkYkbdF7V5aZ1ZPSX8dnwm+p0LBMXFLEIPINx
 3cxOtzNNTvrSMO7KfPylmCHKEni2kwpccRw3jv+K7o57p7sn1tXxRkFRXeQTjakSed7G
 v3shCVZ4UkNCST8vFpz+4Y4FUmT2U3LMDX1T4B6EGu0GhcfXHXXUrJfBcISc0l/SCoPo
 bQuZT//HgSkhAyxv4dBubuzK7XIoVBdOWkvGXXA6rW0nTMcIELZMZMeYl602HnR99f0J
 j6uymtDJt4vyOgKi79h+Ha4J+uNYByZD2UEdlm9Bk5Cj1YOlTJFw4jIwplsGgGjp4h1z
 BGAQ==
X-Received: by 10.25.149.139 with SMTP id x133mr13121823lfd.57.1450202139442; 
 Tue, 15 Dec 2015 09:55:39 -0800 (PST)
Received: from localhost (host-176-37-109-22.la.net.ua. [176.37.109.22])
 by smtp.gmail.com with ESMTPSA id j123sm364561lfb.19.2015.12.15.09.55.38
 (version=TLS1 cipher=AES128-SHA bits=128/128);
 Tue, 15 Dec 2015 09:55:38 -0800 (PST)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "Adrian Chadd" <adrian@freebsd.org>, "Kevin Lo" <kevlo@freebsd.org>,
 "freebsd-wireless@freebsd.org" <freebsd-wireless@freebsd.org>
Subject: Re: coverity scan results for urtwn
References: <CAJ-VmonZYYdhbLhkE=gAGPp6+0sq7fhZNvJJytyXedT8MQOtLw@mail.gmail.com>
Date: Tue, 15 Dec 2015 19:55:37 +0200
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: "Andriy Voskoboinyk" <s3erios@gmail.com>
Message-ID: <op.x9o5ezxoiew4ia@localhost>
In-Reply-To: <CAJ-VmonZYYdhbLhkE=gAGPp6+0sq7fhZNvJJytyXedT8MQOtLw@mail.gmail.com>
User-Agent: Opera Mail/12.16 (FreeBSD)
X-BeenThere: freebsd-wireless@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Discussions of 802.11 stack,
 tools device driver development." <freebsd-wireless.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-wireless/>
List-Post: <mailto:freebsd-wireless@freebsd.org>
List-Help: <mailto:freebsd-wireless-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Dec 2015 17:55:42 -0000

> hiya,
>
> this popped up from the freebsd.org coverity scan:
>
>
> ________________________________________________________________________________________________________
> *** CID 1343338:  Memory - illegal accesses  (OVERRUN)
> /sys/dev/usb/wlan/if_urtwn.c: 4288 in urtwn_r88e_newassoc()
> 4282
> 4283            if (!isnew)
> 4284                    return;
> 4285
> 4286            URTWN_NT_LOCK(sc);
> 4287            for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
>>>>     CID 1343338:  Memory - illegal accesses  (OVERRUN)
>>>>     Overrunning array "sc->node_list" of 63 8-byte elements at  
>>>> element index 63 (byte offset 504) using index "id" (which evaluates  
>>>> to 63).
> 4288                    if (id != URTWN_MACID_BC && sc->node_list[id] ==  
> NULL) {
> 4289                            un->id = id;
> 4290                            sc->node_list[id] = ni;
> 4291                            break;
> 4292                    }
> 4293            }
>
> Would one of you figure it out?
>
> Thanks!
>
>
> -a

#define R88E_MACID_MAX          63
...
struct ieee80211_node           *node_list[R88E_MACID_MAX];

of course, I mean here 64, not 63 (probably, it was a bad idea to replace
first inaccessible element with last accessible).