From owner-freebsd-hackers@FreeBSD.ORG  Fri Aug 20 19:41:43 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3638C16A4CE
	for <hackers@freebsd.org>; Fri, 20 Aug 2004 19:41:43 +0000 (GMT)
Received: from coverity.dreamhost.com (coverity.dreamhost.com [66.33.192.105])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0E03D43D58
	for <hackers@freebsd.org>; Fri, 20 Aug 2004 19:41:43 +0000 (GMT)
	(envelope-from tedu@coverity.com)
Received: from coverity.com (dsl093-171-098.sfo4.dsl.speakeasy.net
	[66.93.171.98])
	by coverity.dreamhost.com (Postfix) with ESMTP id A789190887
	for <hackers@freebsd.org>; Fri, 20 Aug 2004 12:41:42 -0700 (PDT)
Message-ID: <412652AA.5020308@coverity.com>
Date: Fri, 20 Aug 2004 12:36:10 -0700
From: Ted Unangst <tedu@coverity.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040429
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: hackers@freebsd.org
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Sat, 21 Aug 2004 02:56:03 +0000
Subject: off by one bounds
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Aug 2004 19:41:43 -0000

errors in freebsd 4.10 found by Coverity's analysis.

awi_wep.c:awi_wep_setalgo, algo == sizeof
svr4_signal.c:SVR4_NSIG one larger than TBLSIZ
linprocfs_misc.c:linprocfs_doprocstatus, p_stat == sizeof
ibcs2_msg.c:ibcs2_poll, fd == FD_SETSIZE
if_ray.c:ray_rx_mgt_info, len == NWID_LEN
ciss.c:ciss_cam_action_io, target == CISS_MAX_LOGICAL

in6.c:in6_are_prefix_equal len == 128
in6.c:in6_prefixlen2mask, len == 128
ip_icmp.c:ip_next_mtu, i == sizeof, dir >= 0