From owner-freebsd-wireless@freebsd.org  Tue Dec 15 18:00:10 2015
Return-Path: <owner-freebsd-wireless@freebsd.org>
Delivered-To: freebsd-wireless@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3613EA43019
 for <freebsd-wireless@mailman.ysv.freebsd.org>;
 Tue, 15 Dec 2015 18:00:10 +0000 (UTC)
 (envelope-from andriyvos@gmail.com)
Received: from mail-lb0-f169.google.com (mail-lb0-f169.google.com
 [209.85.217.169])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id DAFB51BBA;
 Tue, 15 Dec 2015 18:00:09 +0000 (UTC)
 (envelope-from andriyvos@gmail.com)
Received: by mail-lb0-f169.google.com with SMTP id kw15so10926249lbb.0;
 Tue, 15 Dec 2015 10:00:09 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=content-type:to:subject:references:date:cc:mime-version
 :content-transfer-encoding:from:message-id:in-reply-to:user-agent;
 bh=n9EEGpEgQ8yFc1pzcG1/YB4XhtZuACsQVNTP15ptiR4=;
 b=V+UEfRm4sFPtQUsEK6Ki/nxyh+2xFacrsZjSPlNgO1eWPDVv5T4jVq9+TJ8CNGO5Mi
 vSk2Vw4a/9JxyDfV5QVjgA5fwOBd4HP+cI6f6IlHw/xo5NEJPaPUyCixdZfh6OiZXP0Q
 HcBJO5EYoisZK5Uuh8yvCivUMhwjK5j7hauhpHv6Q542EiZf+FTCZsNF7ZSniBW+NPbY
 hJsvF7Jog2rVn4Nse5/DCrOVH+rEUF3+SESVWtjVcfFWPhh5dM2AZxyAK9xVsU1ldrns
 GIqScMPDcFK6aL/JWeN0TbSiJs9XTuppmABIiFcY/3JDpZokT0LtDDvbw6p209HxkFdo
 qqdA==
X-Received: by 10.112.25.103 with SMTP id b7mr1232753lbg.11.1450202401807;
 Tue, 15 Dec 2015 10:00:01 -0800 (PST)
Received: from localhost (host-176-37-109-22.la.net.ua. [176.37.109.22])
 by smtp.gmail.com with ESMTPSA id j204sm360166lfd.16.2015.12.15.10.00.00
 (version=TLS1 cipher=AES128-SHA bits=128/128);
 Tue, 15 Dec 2015 10:00:01 -0800 (PST)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "Adrian Chadd" <adrian@freebsd.org>
Subject: Re: coverity scan results for urtwn
References: <CAJ-VmonZYYdhbLhkE=gAGPp6+0sq7fhZNvJJytyXedT8MQOtLw@mail.gmail.com>
 <op.x9o5ezxoiew4ia@localhost>
 <CAJ-VmomBz2Nc42RD5ovov=moRx_DKBRGuLQB16FPQZwWTjyUYQ@mail.gmail.com>
Date: Tue, 15 Dec 2015 20:00:01 +0200
Cc: "Kevin Lo" <kevlo@freebsd.org>, "freebsd-wireless@freebsd.org"
 <freebsd-wireless@freebsd.org>
MIME-Version: 1.0
Content-Transfer-Encoding: Quoted-Printable
From: "Andriy Voskoboinyk" <avos@freebsd.org>
Message-ID: <op.x9o5mby84dikkl@localhost>
In-Reply-To: <CAJ-VmomBz2Nc42RD5ovov=moRx_DKBRGuLQB16FPQZwWTjyUYQ@mail.gmail.com>
User-Agent: Opera Mail/12.16 (FreeBSD)
X-BeenThere: freebsd-wireless@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Discussions of 802.11 stack,
 tools device driver development." <freebsd-wireless.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-wireless/>
List-Post: <mailto:freebsd-wireless@freebsd.org>
List-Help: <mailto:freebsd-wireless-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Dec 2015 18:00:10 -0000

Tue, 15 Dec 2015 19:56:18 +0200 =D0=B1=D1=83=D0=BB=D0=BE =D0=BD=D0=B0=D0=
=BF=D0=B8=D1=81=D0=B0=D0=BD=D0=BE Adrian Chadd  =

<adrian@freebsd.org>:

> heh, wanna submit a fix? :)
>

Done. Thanks!

>
>
> -a
>
>
> On 15 December 2015 at 09:55, Andriy Voskoboinyk <s3erios@gmail.com>  =

> wrote:
>>> hiya,
>>>
>>> this popped up from the freebsd.org coverity scan:
>>>
>>>
>>>
>>> ____________________________________________________________________=
____________________________________
>>> *** CID 1343338:  Memory - illegal accesses  (OVERRUN)
>>> /sys/dev/usb/wlan/if_urtwn.c: 4288 in urtwn_r88e_newassoc()
>>> 4282
>>> 4283            if (!isnew)
>>> 4284                    return;
>>> 4285
>>> 4286            URTWN_NT_LOCK(sc);
>>> 4287            for (id =3D 0; id <=3D URTWN_MACID_MAX(sc); id++) {
>>>>>>
>>>>>>     CID 1343338:  Memory - illegal accesses  (OVERRUN)
>>>>>>     Overrunning array "sc->node_list" of 63 8-byte elements at  =

>>>>>> element
>>>>>> index 63 (byte offset 504) using index "id" (which evaluates to 6=
3).
>>>
>>> 4288                    if (id !=3D URTWN_MACID_BC && sc->node_list[=
id]  =

>>> =3D=3D
>>> NULL) {
>>> 4289                            un->id =3D id;
>>> 4290                            sc->node_list[id] =3D ni;
>>> 4291                            break;
>>> 4292                    }
>>> 4293            }
>>>
>>> Would one of you figure it out?
>>>
>>> Thanks!
>>>
>>>
>>> -a
>>
>>
>> #define R88E_MACID_MAX          63
>> ...
>> struct ieee80211_node           *node_list[R88E_MACID_MAX];
>>
>> of course, I mean here 64, not 63 (probably, it was a bad idea to  =

>> replace
>> first inaccessible element with last accessible).
> _______________________________________________
> freebsd-wireless@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-wireless
> To unsubscribe, send any mail to  =

> "freebsd-wireless-unsubscribe@freebsd.org"